Overview

overview

10

Static

static

10

3716-118-0...ry.exe

windows7-x64

1

3716-118-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    3716-118-0x0000000000400000-0x0000000000486000-memory.dmp

  • Size

    536KB

  • MD5

    82cf1323c1613331231146a78edb167d

  • SHA1

    65660b288c91e15a530689885561bdfa7cfbb332

  • SHA256

    9cf960c58fe7d8683f316f89be8dd9e2910066dcb98f6d8e6252bc370ab4fca5

  • SHA512

    115f8ba776a9abfc7bfa290d6d9ea6d2fade0300edf68740f33bf18cef93191d3bbceb0749c4c81159f013bc5c56c148bc58e13128a18039c584223d8622aefc

  • SSDEEP

    1536:K3rPI5jSu1EZ89ZFpXnaHeaD5VBmUmurTtB:YrPI5jSu1Eu3aHZ5VYnurTtB

Score
10/10
isfb555000gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

555000

C2

http://185.212.47.65

http://45.155.249.172

http://78.138.9.136

http://79.132.130.230

https://listwhfite.check3.yaho1o.com

https://lisfwhite.ch2eck.yaheoo.com

http://45.155.250.58

https://liset.che3ck.bi1ng.com

http://45.155.249.91
Attributes
  • base_path

    /zerotohero/

  • build

    250260

  • exe_type

    loader

  • extension

    .asi

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3716-118-0x0000000000400000-0x0000000000486000-memory.dmp
    .exe windows x86


    Headers

    Sections