Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
10/10/2023, 08:53
General
- Target progetto.exe
- Size 294KB
- Sample231010-ktbbssec89
- SHA256 31f983668db02626b9c65b0f2fc7d14b59400c485d4ffc88418f3f76bf62ef85
Score
10/10
Malware Config
Extracted
Family
-
gozi
Extracted
Family
-
gozi
Botnet
-
5050
C2
-
193.203.162.14
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
- Gozi
Gozi is a well-known and widely distributed banking trojan.
Processes
-
C:\Users\Admin\AppData\Local\Temp\progetto.exe"C:\Users\Admin\AppData\Local\Temp\progetto.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2152-1-0x00000000022D0000-0x00000000023D0000-memory.dmp
memory/2152-2-0x0000000000400000-0x0000000002287000-memory.dmp
memory/2152-3-0x0000000002450000-0x000000000245B000-memory.dmp
memory/2152-4-0x0000000004030000-0x000000000403D000-memory.dmp
memory/2152-7-0x00000000022D0000-0x00000000023D0000-memory.dmp
memory/2152-8-0x0000000000400000-0x0000000002287000-memory.dmp