gozi | fe05e50be407f5efcb1870991f86ec721fd7088e92782a60aa815e0a68eb486e | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05-10-2023 18:48

Sharing

Report Analysis Logs

General

Target

clientexe_JC.exe
Size

304KB
MD5

27b1d878636e00e43436184b70e9f41c
SHA1

b175d86922e1e837d8d74b588ff746ea7b8670df
SHA256

fe05e50be407f5efcb1870991f86ec721fd7088e92782a60aa815e0a68eb486e
SHA512

086b34070946d275ef50552969c6e561349299eb7eece513ca4504c84ad7810a02428a1540ecd715541139f500137209c94297a331dfa87c18afa2d91e24349e
SSDEEP

6144:R+91vEOpa6NK56upTHirwtRinshvjxdyhgAw8Fi5r+IxsN+:8Dsf4K56u1HqLshvjxia8Mr+/

Score

10^/10

gozi 5050 banker dave isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

mifrutty.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Dave packer 1 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

Processes:

resource	yara_rule
behavioral1/memory/1676-1-0x0000000000240000-0x000000000024C000-memory.dmp	dave

C:\Users\Admin\AppData\Local\Temp\clientexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\clientexe_JC.exe"
1⤵
PID:1676

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-0-0x0000000000250000-0x000000000025F000-memory.dmp

Filesize
60KB

Download
memory/1676-5-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1676-1-0x0000000000240000-0x000000000024C000-memory.dmp

Filesize
48KB

Download
memory/1676-11-0x0000000000280000-0x000000000028D000-memory.dmp

Filesize
52KB

Download