Overview

overview

10

Static

static

10

9b769e4822...26.dll

windows7-x64

1

9b769e4822...26.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    11666779745.zip

  • Size

    28KB

  • MD5

    0e90df472a7b25eae5653f574b98b13c

  • SHA1

    bfc48ff12996d63d7b0e308efffa00b53f050fbf

  • SHA256

    3e93dbd5b08b343f56a392f0d6ab5866aa2c0af38f8b772246e9b89ca30a0699

  • SHA512

    65040f47c24144d95c4647c0373fdeba402e6dd574d992600f87a7d6b4ed162cdd154043a80fbabe5131032dd5100ba0a1098c7c6bfd60ba6fe34138357c0b7c

  • SSDEEP

    768:G8xfMG5Ajb9hICe42aEqB6eJzhAPmdgSaPMgTOC:G8VM0m2gz5MR

Score
10/10
isfb5050gozi

Malware Config

Extracted

Family

gozi

Botnet

5050

C2

config.edge.skype.com

optinetwork.top

onlynetwork.top

internetcoca.in

dendexmm.com
Attributes
  • base_path

    /jerry/

  • build

    250249

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 11666779745.zip
    .zip

    Password: infected

  • 9b769e4822c4820aeea6523972c025754e3186f520f76491f76ef4d316f06226
    .dll windows x86

    Password: infected

    b1e1d582732e4e48ca192109b68c23b4


    Headers

    Imports

    Sections