Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
05-10-2023 18:48
General
-
Target
clientexe_JC.exe
-
Size
304KB
-
MD5
27b1d878636e00e43436184b70e9f41c
-
SHA1
b175d86922e1e837d8d74b588ff746ea7b8670df
-
SHA256
fe05e50be407f5efcb1870991f86ec721fd7088e92782a60aa815e0a68eb486e
-
SHA512
086b34070946d275ef50552969c6e561349299eb7eece513ca4504c84ad7810a02428a1540ecd715541139f500137209c94297a331dfa87c18afa2d91e24349e
-
SSDEEP
6144:R+91vEOpa6NK56upTHirwtRinshvjxdyhgAw8Fi5r+IxsN+:8Dsf4K56u1HqLshvjxia8Mr+/
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
mifrutty.com
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes
-
C:\Users\Admin\AppData\Local\Temp\clientexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\clientexe_JC.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
48KB
-
Filesize
52KB