Overview

overview

10

Static

static

10

gozi.dll

windows7-x64

1

gozi.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    gozi.payload-disk

  • Size

    43KB

  • MD5

    5334bd5ed3b8e878a14180fa023713bb

  • SHA1

    22463f0e73374a8ce97316b2ecfbec4bfaec5dc9

  • SHA256

    48c0976b47625e90abe61f6a46e00434a50bc42a51600ec337007733708c867a

  • SHA512

    7d92c448c284c35c522ef0cc0f4315cb7234504eabd3ad7d789d3f5dae9765f94493aa54a2edf32b83c19f231203bedab08b14e804fc0127f80145276377b5c3

  • SSDEEP

    768:as0zIQOuf1WrHWngROYD3Ps8WyAqa5v+BZ20efofs7gpdsmT:asSIQO8184gRO8sxp+BE0efUs7K1T

Score
10/10
isfb5050gozi

Malware Config

Extracted

Family

gozi

Botnet

5050

C2

https://fazz.bing.com/check

http://swebbers.com
Attributes
  • base_path

    /jerry/

  • build

    250257

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • gozi.payload-disk
    .dll windows x86

    ef075d26b728b78a932306e24062e80c


    Headers

    Imports

    Sections