Overview

overview

10

Static

static

10

2484-54-0x...ry.dll

windows7-x64

3

2484-54-0x...ry.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2484-54-0x0000000000030000-0x000000000003D000-memory.dmp

  • Size

    52KB

  • MD5

    0613d6b354c5507d155ec13f234641b9

  • SHA1

    2c31f9ffb84d36977b4d881e07afcfd2f9a93a15

  • SHA256

    ec4639282d564a00609c186a3f5e179e662740f8d2c7cd5cc95f0e19fa33c206

  • SHA512

    9cbafa2b88844641d685f7c761e49c5705ca1a750ab466e7a6bd50e801b01aacfd7bf4f2aa981bff13bf161a2a5f70e18f1728a7c4a5aa251923b729b013bf7f

  • SSDEEP

    1536:Xuhrx/qSj+m9Xfhs6TPLjXjXJOsMqEXOO:Xuhrx/qw+mjVLL7VOsMq4

Score
10/10
isfb878155gozi

Malware Config

Extracted

Family

gozi

Botnet

878155

C2

http://185.212.47.65

http://45.155.249.172

http://78.138.9.136

http://79.132.130.230

https://listwhfite.check3.yaho1o.com

https://lisfwhite.ch2eck.yaheoo.com

http://45.155.250.58

https://liset.che3ck.bi1ng.com

http://45.155.249.91
Attributes
  • base_path

    /zerotohero/

  • build

    250260

  • exe_type

    loader

  • extension

    .asi

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2484-54-0x0000000000030000-0x000000000003D000-memory.dmp
    .dll windows x86


    Headers

    Sections