Overview

overview

10

Static

static

10

bcd0000.dll

windows7-x64

1

bcd0000.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    bcd0000.dll

  • Size

    229KB

  • MD5

    6a5b2a82fd76eae337397c3bfb163544

  • SHA1

    28a422d69165872e2e6e41639ad7b437b5a7528e

  • SHA256

    7203bb5ec300ca74ec9dc8577737a204cb2e7a992f420f92395a2c6f85037d07

  • SHA512

    8738ebb7531127573e4eecebc2f9513a50be6d772f80c9281b813d7c403b605751212bf4269c79e416a5685e8928880a82266246062e5e70f5bf0f62b4859c41

  • SSDEEP

    6144:iX72v82Wldh1KeRFSbaWrxls9cPor5b5G:iL2v8znYSSeWr497

Score
10/10
isfb555000gozi

Malware Config

Extracted

Family

gozi

Botnet

555000

C2

http://185.212.44.76

http://79.132.135.249

http://45.155.249.47

http://45.11.180.178

https://lyc.l.ly3cos.com

https://updates.ya3hoo.yah4oo.com

http://45.11.181.28

https://forum4ate.ad.b1ing.com

http://94.247.42.124

https://updat4es.yahoo.yah1oo.com

http://45.155.249.94

https://updates.yahoo.yah1oo.com

http://79.132.135.228

https://updates.yahoo.yah4oo.com

http://79.132.130.234
Attributes
  • base_path

    /cgiscript/

  • exe_type

    worker

  • extension

    .asi

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bcd0000.dll
    .dll windows x64

    81de4ee1071a8320787d7c9e149ace7f


    Headers

    Imports

    Sections