Overview

overview

10

Static

static

10

gozi.dll

windows7-x64

1

gozi.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    gozi.payload-disk

  • Size

    43KB

  • MD5

    f88533912f3d839df9f9025ebac95f6e

  • SHA1

    2a830f0d6e86480d14dada2d0b95753c3bfc7e39

  • SHA256

    441411ab1d8ab7913e15bdb536c8bdac36c240b11b57de8106c3d73199f94afe

  • SHA512

    02451236878871ef0590b5924339d238227d66c4caa6448474890de759d2736f8b8b673e3073164db884d66fc9c2ee7b87e21e2722df334fcd0b84a18f6678fa

  • SSDEEP

    768:Ns0zIQOuf1WrHWngROYD3Ps8WyAqa5v+BZ20efofs7gpdsmT:NsSIQO8184gRO8sxp+BE0efUs7K1T

Score
10/10
isfb5050gozi

Malware Config

Extracted

Family

gozi

Botnet

5050

C2

https://fazz.bing.com/check

http://provaterta.com
Attributes
  • base_path

    /jerry/

  • build

    250257

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • gozi.payload-disk
    .dll windows x86

    ef075d26b728b78a932306e24062e80c


    Headers

    Imports

    Sections