Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
09-10-2023 18:21
General
-
Target
client.exe
-
Size
359KB
-
MD5
5afca9ef360236eaf6e55b2d8ce114be
-
SHA1
7d2919aa03a96c91cc4d0724906c572e12a14d75
-
SHA256
7e2adc1e8273c9662cc51304835805cc31d1a65c5b151789b69e5441cb666465
-
SHA512
a52ca21d09fb22a85d5c01301f6d07538b1315764c07772ec0eb5c15d20cec5bc592213995d78e5b0f1bd4db41c605dc66057ef6c1043bc176e27c0b795ca2a8
-
SSDEEP
6144:Lmjuf/Ei1AhA8QZtEH7wjYjjrF5GPKWpnSi97Q/VqMITAWWSlhEszcC:Lbf/P19b47wjYjj6dAAMoH7lhHcC
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
http://iextrawebty.com
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
52KB