Overview

overview

10

Static

static

3

713061a3f1...cf.exe

windows7-x64

10

713061a3f1...cf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    713061a3f104a116e82686dcc3d7c28e6bac0ea519a166c43a65b2f10cd0bdcf.zip

  • Size

    138KB

  • Sample

    231006-sdwa2add91

  • MD5

    397e5d7d243c8922b3c2b1ada1577402

  • SHA1

    17de40301853a8d40ee1d4b6f248dbfd286f1d25

  • SHA256

    8821d1f657b5d5a7bbbe7c73eb1b596f0fc935e70d1321b1ac994f3283cc467e

  • SHA512

    6a41388c5dfc694d78591fcb1c7f4c4ca9648712bd0b55bc12f8e842974eb92426b784f14afe745bb2c6a1dc0216a919981e8d08c8e6509e83aff396f55f94b9

  • SSDEEP

    3072:5AhArW5FgEpn3TvOUYXquNiDJU9OosyzNenC/caReAo:YTgYTvO5qVJ6OVJnC5Q

Score
10/10
gozi5050bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

mifrutty.com

Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      713061a3f104a116e82686dcc3d7c28e6bac0ea519a166c43a65b2f10cd0bdcf.exe

    • Size

      292KB

    • MD5

      f63d00d962c43095a6de3838401e5b59

    • SHA1

      c49feab758326a965d30fef2807291cf39c0d61a

    • SHA256

      713061a3f104a116e82686dcc3d7c28e6bac0ea519a166c43a65b2f10cd0bdcf

    • SHA512

      12f2fa8d97edcc5e045d222bc0b74521767f13bc18d190a965b14095367e73fb24cd387e354f345675954f47fdd9e174ff8e257b32e7aaa04cd22b1b17cbd9d7

    • SSDEEP

      3072:/girqLkRXUklcl8F0W6IbV418GM7cCtHEaV0AtdQa9l0Ck5jU:/gY9RJ2l8Nrdb3Q8l0Zj

    Score
    10/10
    gozi5050bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks