Overview

overview

10

Static

static

10

1692-0-0x0...ry.exe

windows7-x64

1

1692-0-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    1692-0-0x0000000000400000-0x0000000000485000-memory.dmp

  • Size

    532KB

  • MD5

    66384ce60351fa0d1cd401060dc52e8b

  • SHA1

    8da9245ab16f48c97ffc6ca88c3557bce0ca92a2

  • SHA256

    fbd7b70bc9fea91dd00d3468e8b9f8229736b93117abad2792f759fcd980c7fe

  • SHA512

    dcbd2e32f799c61f58f872b0ae44c46f8da7678ae866ff285af44961ce3938cd2a3b7fe4ccb507a474f5a1f4231529846f86f8bf89810db75eeae9558e843b17

  • SSDEEP

    1536:z5g6LRCPSGVJHSrLhum4LjwVlVPmgt0nT:z5RLRCPSgJVm4IBP0

Score
10/10
isfb222001gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

222001

C2

http://45.155.249.170

https://listwhfidte.check3.yaho1o.com

http://94.247.42.215

https://lisfwhidte.ch2eck.yaheoo.com

http://91.242.217.120

https://liset.ched3ck.bi1ng.com
Attributes
  • base_path

    /zerotohero/

  • build

    250260

  • exe_type

    loader

  • extension

    .asi

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1692-0-0x0000000000400000-0x0000000000485000-memory.dmp
    .exe windows:5 windows x86


    Headers

    Sections