Overview

overview

10

Static

static

10

2452-2-0x0...ry.exe

windows7-x64

1

2452-2-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2452-2-0x0000000000400000-0x000000000044A000-memory.dmp

  • Size

    296KB

  • Sample

    230929-yq59nafg65

  • MD5

    0c321b2e4514d4bf91bb5d0f6ad0034e

  • SHA1

    e73858eb6a6efe690d8d98abf249cd73ccc55c76

  • SHA256

    f03a47e4ec2d04757a09becc9a891b4e4a64aa3c520d6b01b37e8b164e208ee9

  • SHA512

    ce2c7393dc95d18c3259744bc5aad5001edb179669e04bd2c9454e18c86bd9ed057cd04c1f9a06396b74a36eb2d1d4fb2076668e8858d957284d2b8f6acb6c91

  • SSDEEP

    3072:KrPI5jSu1DtEPrYLubTtT+MXpZSylO6d1v01wtialvaTAIns5chZTrbp:iu1DtEPr7ftznPO6dVQWIBjTJ

Score
10/10
gozi5050isfb

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

31.41.44.28

146.19.233.250

46.8.19.158
Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      2452-2-0x0000000000400000-0x000000000044A000-memory.dmp

    • Size

      296KB

    • MD5

      0c321b2e4514d4bf91bb5d0f6ad0034e

    • SHA1

      e73858eb6a6efe690d8d98abf249cd73ccc55c76

    • SHA256

      f03a47e4ec2d04757a09becc9a891b4e4a64aa3c520d6b01b37e8b164e208ee9

    • SHA512

      ce2c7393dc95d18c3259744bc5aad5001edb179669e04bd2c9454e18c86bd9ed057cd04c1f9a06396b74a36eb2d1d4fb2076668e8858d957284d2b8f6acb6c91

    • SSDEEP

      3072:KrPI5jSu1DtEPrYLubTtT+MXpZSylO6d1v01wtialvaTAIns5chZTrbp:iu1DtEPr7ftznPO6dVQWIBjTJ

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks