Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
03-10-2023 06:20
General
-
Target
client.exe
-
Size
230KB
-
MD5
a79e4eb10421a51f959dbfab392085fa
-
SHA1
315a5353b418a066ea5c6c44faf25eac55c81be6
-
SHA256
6ac7ce03310cde657eec90facfa67bc6c878a413c462858fc671c1e8acc670f3
-
SHA512
1417ed6cc0b8c41c31ada8136951a52df6a43512c39333be4b5044072f0806018a11ae9b22687a46c237e762a653f903e37f4c40e5fb3ddf83a0bdfed38c4023
-
SSDEEP
3072:JtFok3nTwth5eKvu+95JG3D9TcUonLpq1/xE02WKteBczMCLVIr4upCe7CelPg9:3FjnEtHe8ubzbWdOGWKtNVmX/Zg9
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
46.8.210.250
31.41.44.9
185.247.184.139
62.72.33.155
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
48KB
-
Filesize
52KB