Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
10-10-2023 10:07
General
-
Target
parte.exe
-
Size
293KB
-
MD5
aaed27e1be51e10d145157125182f80e
-
SHA1
51e7bceb1b2f4d696120fd63053990a78baf6905
-
SHA256
d8f9367ba0766cdae24e569453778a563689a671074096915b69f26aeb5c3efd
-
SHA512
217d6d439392e7609bf1b9206dde1aaf36310046862f06e4e1444bd90735f180914c06fb2d0ef2ea1cc7d6760e46b00a44befaad75be7c5ec659c949d73ff3fd
-
SSDEEP
3072:XlT6GTvS2Xv+9zxqbBBqnwT0jax0bHZDu2tKYAVaJRaW/aT:8w9v+9CBqnwTAaxEDZIYa
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
193.203.162.14
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
Processes
-
C:\Users\Admin\AppData\Local\Temp\parte.exe"C:\Users\Admin\AppData\Local\Temp\parte.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
30.5MB
-
Filesize
52KB
-
Filesize
1024KB
-
Filesize
30.5MB
-
Filesize
44KB