Overview

overview

10

Static

static

10

196445c0000.dll

windows7-x64

1

196445c0000.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    196445c0000.dll

  • Size

    240KB

  • MD5

    10fa7b9d25248dbf52c216e1cbc4ffb2

  • SHA1

    c55670d3177e2ca6b9ada940a4d4d768fd2eea97

  • SHA256

    011780d560020ede52c6d147cf31145d9376944829e56c4331788acdb30256ed

  • SHA512

    df0c686add14494b5e9af8ee665301f5e5806bedda75b0b4f494b50eab417e3decabcb215b078f60113d21ef395a2753ce552c971d0228f755a8a8c8ce90d239

  • SSDEEP

    6144:y9HEhbASTf5azHTz2V5g3B63qgkabI5Gz+1:SW0mf5CHTz2V5463qgkabHq1

Score
10/10
isfb5050gozi

Malware Config

Extracted

Family

gozi

Botnet

5050

C2

https://avas1t.de/in/loginq/

31.172.83.49

109.105.198.129

delideta.com
Attributes
  • base_path

    /pictures/

  • exe_type

    worker

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 196445c0000.dll
    .dll windows x64

    81de4ee1071a8320787d7c9e149ace7f


    Headers

    Imports

    Sections