General

  • Target

    12146133222.zip

  • Size

    132KB

  • Sample

    231004-t3ym5ada7x

  • MD5

    ca62fc5bf349f31049685cfd363666e1

  • SHA1

    7f3bd836191fce423caffabf2173bb7d0f1dc83d

  • SHA256

    2308e6d718e12ec988f6d6e159904cba0a7ba4889cbfb4dcb78b1e3f496faa4a

  • SHA512

    be83698c8e66c01cd2fb66ff58c81091ae23e793d2e9d05da5a9bea51cc224e76fc6c83e3848f242c7f8238d17e53b0426787ad285ccdc84f66bfcc4e8d6cba7

  • SSDEEP

    3072:6pnhPOt8C8iY0Ij9Dag8B2Eb14rE5vHluMrCvw+TEDD7F:ulS8C8i9IjEpuEhHZrCI+TEh

Score
10/10

Malware Config

Extracted

Family

gozi

Botnet

2000

C2

trackingg2-protectioon.cdn4.mozilla.net

109.230.199.185

trackingg3-protectioon.cdn5.mozilla.net

185.212.44.249

trackingg4-protectioon.cdn5.mozilla.net

194.76.225.37

trackingg5-protectioon.cdn1.mozilla.net

194.76.224.181

trackingg-protectioon.cdn1.mozilla.net

194.76.225.164

trackingg3-protectioon.cdn6.mozilla.net

185.158.251.205

trackingg-protectioon.cdn2.mozilla.net

185.189.149.216

trackingg5-protectioon.cdn3.mozilla.net

185.158.249.54

trackingg-protectioon.cdn4.mozilla.net

185.212.44.130

trackingg1-protectioon.cdn5.mozilla.net

37.10.71.83

Attributes
  • base_path

    /fonts/

  • exe_type

    worker

  • extension

    .bak

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      cf043012ad2be371b8f945ac4952f79d9484f74d8e5fe9a08970d0df748927ab

    • Size

      228KB

    • MD5

      270766d629197f6c557768e0008fecd3

    • SHA1

      2a9b9b1a995d9e4f67148eef6420ec141580a47e

    • SHA256

      cf043012ad2be371b8f945ac4952f79d9484f74d8e5fe9a08970d0df748927ab

    • SHA512

      d8bf98974a415c273c929888c8b5095a58bb8d32348ef8a6cf092aaceca97343811217a5b1664903093cb924c267b01da8fce2412903b16c6906df2c6d5f94e4

    • SSDEEP

      3072:3lfGqwJTeTEom3lIkR2SCD6q9KgyItk78mV0dfgxT/cqA9w5VgCK5hcj2RxJFoc:3lDosEPR66q9KgylInd6oqA9D5rnFoc

    Score
    1/10

MITRE ATT&CK Matrix

Tasks