General
-
Target
windows.sig
-
Size
4.5MB
-
MD5
96750118e244a2afe885ad737b3dfd84
-
SHA1
8e86e84c5672d5d365b8553ba9cedc927b0df1b9
-
SHA256
318526b108539af55ec23b5a9720441d39e944e222e5322455a9845d99d4ad04
-
SHA512
0d0fb426074f0c6e1bbaa5579d16b62ba51096d56a83c652fddb72da472d5a9355f75d66645b648b4b9d8dedaaf2514d13a07cc2c91e81e40e1846fb7d719ecc
-
SSDEEP
24576:DTYQHui+zuYJod2mSBhkVa+Q3KhKa3KBpPk:vYXiSB5ZGePk
Score
10/10
Malware Config
Extracted
Family
gozi
Signatures
-
AmmyyAdmin payload 1 IoCs
-
Ammyyadmin family
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
Detected SUNBURST backdoor 1 IoCs
SUNBURST is a backdoor for the SolarWinds Orion platform with extensive capabilities.
-
Gozi family
-
Remcos family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Sunburst family
Files
-
windows.sig