Overview

overview

10

Static

static

10

4594787330...43.exe

windows10-1703-x64

1

4594787330...43.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    45947873301645fa58c8243a3d9df9bdd866bf8fbeb085b3484de71d09957c43

  • Size

    60KB

  • MD5

    80a7b83c8afe43ae666118cd7a5e1e7e

  • SHA1

    2257ab264880bc99d6ef37665a12df4348aff42e

  • SHA256

    45947873301645fa58c8243a3d9df9bdd866bf8fbeb085b3484de71d09957c43

  • SHA512

    10893b997c853e92b9e4b005a41cdd421f7318465b7418587d2ee86b7e714f39e092f861c94df25e98d94221715b57e8cfb0754eb076ad4329d85bb78a7aefb4

  • SSDEEP

    1536:O3rPI5jSu13c89ZFpXnaHeaD5VBmUmurTtB:crPI5jSu13b3aHZ5VYnurTtB

Score
10/10
isfb555000gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

555000

C2

http://185.212.47.65

http://45.155.249.172

http://78.138.9.136

http://79.132.130.230

https://listwhfite.check3.yaho1o.com

https://lisfwhite.ch2eck.yaheoo.com

http://45.155.250.58

https://liset.che3ck.bi1ng.com

http://45.155.249.91
Attributes
  • base_path

    /zerotohero/

  • build

    250260

  • exe_type

    loader

  • extension

    .asi

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 45947873301645fa58c8243a3d9df9bdd866bf8fbeb085b3484de71d09957c43
    .exe windows x86

    1640d668d1471f340cbe565fe63522f6


    Headers

    Imports

    Sections