gozi | 988ac9d35c37f6e957a5f292b871325fece89e106d4ac91d61d7ef5cd657ad8a | Triage

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06-10-2023 11:38

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.TrojanX-gen.25123.exe
Size

293KB
MD5

f4596eec21608b69a6410f3c1163f290
SHA1

db1d45bdd0409d95f6d3b6084cad4e6fe90a3436
SHA256

988ac9d35c37f6e957a5f292b871325fece89e106d4ac91d61d7ef5cd657ad8a
SHA512

c8d70e20cb3db7f050a0cb75d9f4ae3099760507eb707951c602f2d2de6adb564f87425153c77cae5b465c5efa7f5b4b13be642f8c95c9e14ed2d007e29e8dce
SSDEEP

3072:IvjRMbYbmYQDtBRd7QuszTc3iHjL1473r49ot:eWYaYQzRhSOuL1ik9o

Score

10^/10

gozi 5050 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

mifrutty.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.25123.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.25123.exe"
1⤵
PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2452-1-0x00000000023D0000-0x00000000024D0000-memory.dmp

Filesize
1024KB

Download
memory/2452-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2452-3-0x0000000000400000-0x000000000228F000-memory.dmp

Filesize
30.6MB

Download
memory/2452-4-0x00000000002C0000-0x00000000002CD000-memory.dmp

Filesize
52KB

Download
memory/2452-7-0x00000000023D0000-0x00000000024D0000-memory.dmp

Filesize
1024KB

Download
memory/2452-9-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2452-8-0x0000000000400000-0x000000000228F000-memory.dmp

Filesize
30.6MB

Download