Overview

overview

10

Static

static

3

client.exe

windows7-x64

10

client.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    client.exe

  • Size

    359KB

  • Sample

    231009-wza4rshd82

  • MD5

    5afca9ef360236eaf6e55b2d8ce114be

  • SHA1

    7d2919aa03a96c91cc4d0724906c572e12a14d75

  • SHA256

    7e2adc1e8273c9662cc51304835805cc31d1a65c5b151789b69e5441cb666465

  • SHA512

    a52ca21d09fb22a85d5c01301f6d07538b1315764c07772ec0eb5c15d20cec5bc592213995d78e5b0f1bd4db41c605dc66057ef6c1043bc176e27c0b795ca2a8

  • SSDEEP

    6144:Lmjuf/Ei1AhA8QZtEH7wjYjjrF5GPKWpnSi97Q/VqMITAWWSlhEszcC:Lbf/P19b47wjYjj6dAAMoH7lhHcC

Score
10/10
gozi5050bankerdaveisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

http://iextrawebty.com

Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      client.exe

    • Size

      359KB

    • MD5

      5afca9ef360236eaf6e55b2d8ce114be

    • SHA1

      7d2919aa03a96c91cc4d0724906c572e12a14d75

    • SHA256

      7e2adc1e8273c9662cc51304835805cc31d1a65c5b151789b69e5441cb666465

    • SHA512

      a52ca21d09fb22a85d5c01301f6d07538b1315764c07772ec0eb5c15d20cec5bc592213995d78e5b0f1bd4db41c605dc66057ef6c1043bc176e27c0b795ca2a8

    • SSDEEP

      6144:Lmjuf/Ei1AhA8QZtEH7wjYjjrF5GPKWpnSi97Q/VqMITAWWSlhEszcC:Lbf/P19b47wjYjj6dAAMoH7lhHcC

    Score
    10/10
    gozi5050bankerdaveisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks