gozi | 911bb31927c7250b4741063159cccf6549e4a28ce6b0a5043d3392c7fce401e4 | Triage

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06-10-2023 21:40

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.TrojanX-gen.32115.21526.exe
Size

274KB
MD5

d18f3fecf6d28ddd0f4cf4a9b53c0aec
SHA1

05263b9ec69fcf48cc71443ba23545fabe21df12
SHA256

911bb31927c7250b4741063159cccf6549e4a28ce6b0a5043d3392c7fce401e4
SHA512

4629ce7f35716bd2c0fc3c14104251c6b2f3eaf07f7b35cf181654d6bc9be85bda6cb6f802b00f98c6bbb446db4790940605dcf8f8d6391282281ac029ff0512
SSDEEP

3072:utyJSwPI9F4BwVVO+kjH4wjyIphvo3ZDivScpBaa4l8QU:iyrPa4BI7wuIphg3ZDi6cnA8Q

Score

10^/10

gozi 5050 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

mifrutty.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32115.21526.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32115.21526.exe"
1⤵
PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-1-0x0000000002370000-0x0000000002470000-memory.dmp

Filesize
1024KB

Download
memory/1824-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/1824-3-0x0000000000400000-0x000000000228B000-memory.dmp

Filesize
30.5MB

Download
memory/1824-4-0x0000000000350000-0x000000000035D000-memory.dmp

Filesize
52KB

Download
memory/1824-7-0x0000000002370000-0x0000000002470000-memory.dmp

Filesize
1024KB

Download
memory/1824-9-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/1824-8-0x0000000000400000-0x000000000228B000-memory.dmp

Filesize
30.5MB

Download