General

  • Target

    windows.sig

  • Size

    4.5MB

  • MD5

    96750118e244a2afe885ad737b3dfd84

  • SHA1

    8e86e84c5672d5d365b8553ba9cedc927b0df1b9

  • SHA256

    318526b108539af55ec23b5a9720441d39e944e222e5322455a9845d99d4ad04

  • SHA512

    0d0fb426074f0c6e1bbaa5579d16b62ba51096d56a83c652fddb72da472d5a9355f75d66645b648b4b9d8dedaaf2514d13a07cc2c91e81e40e1846fb7d719ecc

  • SSDEEP

    24576:DTYQHui+zuYJod2mSBhkVa+Q3KhKa3KBpPk:vYXiSB5ZGePk

Malware Config

Extracted

Family

gozi

Signatures

  • AmmyyAdmin payload 1 IoCs
  • Ammyyadmin family
  • Async RAT payload 1 IoCs
  • Asyncrat family
  • Detected SUNBURST backdoor 1 IoCs

    SUNBURST is a backdoor for the SolarWinds Orion platform with extensive capabilities.

  • Gozi family
  • Remcos family
  • StormKitty payload 1 IoCs
  • Stormkitty family
  • Sunburst family

Files

  • windows.sig