Overview

overview

10

Static

static

10

gozi.dll

windows7-x64

1

gozi.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gozi.payload-disk

  • Size

    43KB

  • MD5

    95c372d22574901ce411aeee1f03e9d2

  • SHA1

    7237abf4b62238c079269ea5460e27311c625209

  • SHA256

    85d2696bbfe4a3ea258f773d1d2e55fe86805baf3c5ddceb65809b0a30f51180

  • SHA512

    20f78f6189391cea7b838d274cf5889304a31069201a7ea4afe410f1bc0d64996fbdd78da8eae3f49029b22235991af58fea2072f48b2e1fa3b6d910a98b1fbb

  • SSDEEP

    768:Vs0zIQOuf1WrHWngROYD3Ps8WyAqa5v+BZ20efofs7gpdsmT:VsSIQO8184gRO8sxp+BE0efUs7K1T

Score
10/10
isfb555756gozi

Malware Config

Extracted

Family

gozi

Botnet

555756

C2

http://logonn.biinng.com

http://78.153.130.9

http://llogiin.biinng.com

http://45.15.157.239
Attributes
  • base_path

    /zerotohero/

  • build

    250257

  • exe_type

    loader

  • extension

    .asi

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • gozi.payload-disk
    .dll windows x86

    ef075d26b728b78a932306e24062e80c


    Headers

    Imports

    Sections