Overview

overview

10

Static

static

3

713061a3f1...cf.exe

windows7-x64

10

713061a3f1...cf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-10-2023 15:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    713061a3f104a116e82686dcc3d7c28e6bac0ea519a166c43a65b2f10cd0bdcf.exe

  • Size

    292KB

  • MD5

    f63d00d962c43095a6de3838401e5b59

  • SHA1

    c49feab758326a965d30fef2807291cf39c0d61a

  • SHA256

    713061a3f104a116e82686dcc3d7c28e6bac0ea519a166c43a65b2f10cd0bdcf

  • SHA512

    12f2fa8d97edcc5e045d222bc0b74521767f13bc18d190a965b14095367e73fb24cd387e354f345675954f47fdd9e174ff8e257b32e7aaa04cd22b1b17cbd9d7

  • SSDEEP

    3072:/girqLkRXUklcl8F0W6IbV418GM7cCtHEaV0AtdQa9l0Ck5jU:/gY9RJ2l8Nrdb3Q8l0Zj

Score
10/10
gozi5050bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

mifrutty.com

Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

Processes

  • C:\Users\Admin\AppData\Local\Temp\713061a3f104a116e82686dcc3d7c28e6bac0ea519a166c43a65b2f10cd0bdcf.exe
    "C:\Users\Admin\AppData\Local\Temp\713061a3f104a116e82686dcc3d7c28e6bac0ea519a166c43a65b2f10cd0bdcf.exe"
    1⤵
      PID:5048

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/5048-1-0x00000000024D0000-0x00000000025D0000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/5048-2-0x00000000023E0000-0x00000000023EB000-memory.dmp
      Filesize

      44KB

      Download
    • memory/5048-3-0x0000000000400000-0x000000000228F000-memory.dmp
      Filesize

      30.6MB

      Download
    • memory/5048-4-0x0000000000400000-0x000000000228F000-memory.dmp
      Filesize

      30.6MB

      Download
    • memory/5048-5-0x00000000024D0000-0x00000000025D0000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/5048-6-0x00000000023E0000-0x00000000023EB000-memory.dmp
      Filesize

      44KB

      Download
    • memory/5048-7-0x0000000000400000-0x000000000228F000-memory.dmp
      Filesize

      30.6MB

      Download
    • memory/5048-10-0x0000000002400000-0x000000000240D000-memory.dmp
      Filesize

      52KB

      Download
    • memory/5048-13-0x0000000000400000-0x000000000228F000-memory.dmp
      Filesize

      30.6MB

      Download