Overview

overview

10

Static

static

10

dc641a8515...c8.dll

windows7-x64

1

dc641a8515...c8.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    12123834144.zip

  • Size

    132KB

  • MD5

    501be31724a9cc7db6478729121f4c86

  • SHA1

    43d2c2b5ec2dfcbd29b44e4d1fe2bf785a70b387

  • SHA256

    c0d87b1aabfebda3315eb5958eccd912c7511577f386a03116853b9108aab6c4

  • SHA512

    810f1efdd02cc6c89958c5c9cba39c82992a6b669279845b2c241407f518b864dee65d12fa3c2a4b71818b0d6ff7632a827e16a9da8ec3f45334fba4769c61d0

  • SSDEEP

    3072:QpnhPOt8C8iY0Ij9Dag8B2Eb14rE5vHlA30Bv:wlS8C8i9IjEpuEhHzv

Score
10/10
isfb2000gozi

Malware Config

Extracted

Family

gozi

Botnet

2000

C2

trackingg2-protectioon.cdn4.mozilla.net

109.230.199.185

trackingg3-protectioon.cdn5.mozilla.net

185.212.44.249

trackingg4-protectioon.cdn5.mozilla.net

194.76.225.37

trackingg5-protectioon.cdn1.mozilla.net

194.76.224.181

trackingg-protectioon.cdn1.mozilla.net

194.76.225.164

trackingg3-protectioon.cdn6.mozilla.net

185.158.251.205

trackingg-protectioon.cdn2.mozilla.net

185.189.149.216

trackingg5-protectioon.cdn3.mozilla.net

185.158.249.54

trackingg-protectioon.cdn4.mozilla.net

185.212.44.130

trackingg1-protectioon.cdn5.mozilla.net

37.10.71.83
Attributes
  • base_path

    /fonts/

  • exe_type

    worker

  • extension

    .bak

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 12123834144.zip
    .zip

    Password: infected

  • dc641a85150af5ede0e9a4ab23144a578889bbee7163addf9e97b5fab7d09fc8
    .dll windows:5 windows x64

    Password: infected

    81de4ee1071a8320787d7c9e149ace7f


    Headers

    Imports

    Sections