Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
04-10-2023 17:55
General
-
Target
6192a4330bfb0117d71982482bb31f6a04936ad827db57d38b4d52ad3f3d78e1_JC.exe
-
Size
208KB
-
MD5
1e4a7b79f273ee339403720850f9d034
-
SHA1
d8aeb3e58d24d29680d2b3dc1a92cba996d62a5c
-
SHA256
6192a4330bfb0117d71982482bb31f6a04936ad827db57d38b4d52ad3f3d78e1
-
SHA512
d85028c08d12ece1697aea6d50990b0ad2092f8f2346cb9f4d0fff27dcb50c6490cfe6d89815efbf6dd1e03c1d1f7e6f53168a94359d0b09461af4119a5997a5
-
SSDEEP
3072:AXV8MV3C77qRKKUSz3yTg/txvxo1Ry6ZN6rG+bZmobGAZHlCR8uUlB/961C03Mzp:c8Ms7IKIVS1w6ZNw08PL/k53Mzp
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
46.8.210.250
31.41.44.9
185.247.184.139
62.72.33.155
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6192a4330bfb0117d71982482bb31f6a04936ad827db57d38b4d52ad3f3d78e1_JC.exe"C:\Users\Admin\AppData\Local\Temp\6192a4330bfb0117d71982482bb31f6a04936ad827db57d38b4d52ad3f3d78e1_JC.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4240-0-0x00000000010F0000-0x00000000010FF000-memory.dmpFilesize
60KB
-
memory/4240-1-0x00000000010E0000-0x00000000010EC000-memory.dmpFilesize
48KB
-
memory/4240-5-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/4240-11-0x0000000002C10000-0x0000000002C1D000-memory.dmpFilesize
52KB