Overview

overview

10

Static

static

10

unpacked_sample.dll

windows7-x64

unpacked_sample.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    unpacked_sample.dll

  • Size

    56KB

  • MD5

    d960b574ee755efb105b16ddcb6e8ac4

  • SHA1

    c9065f7aa61a613f0caece1fba92183d75619427

  • SHA256

    f59b112154fa7b5d054be2543b3ece90ba0c1eb828edc2636602368f2213aadc

  • SHA512

    167ce1a182c0756ebff40cceed6ef7ae66b19d854e5ba258e135f4c514c2b321e7ed8364e6436aa4a50ca9b74b606a11e82afe0b5fd9c7116411e37898ad509c

  • SSDEEP

    768:A2XtFm6/yekvj2va2FyZWjlC/gL8MNF7yNcYNzB1BA5V53vrUZKmdbhrknZ:xi6qeSjpUAsw/gfBWD1ybm1hiZ

Score
10/10
isfb5050gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

https://avas1ta.com/in/login/

itwicenice.com
Attributes
  • base_path

    /jerry/

  • build

    250259

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • unpacked_sample.dll
    .dll regsvr32 windows x86

    3e85858f9f91b022a15a56437fb6f7c2


    Headers

    Imports

    Exports

    Sections