Overview

overview

10

Static

static

3

7e2adc1e82...65.exe

windows7-x64

10

7e2adc1e82...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5afca9ef360236eaf6e55b2d8ce114be.bin

  • Size

    199KB

  • Sample

    231011-b7qtzahe8x

  • MD5

    451a11bcbd688f173c264c008e5b1ebe

  • SHA1

    6490e4f83f6109ce637a97ae4e5b1f07155203b1

  • SHA256

    14701146d31e891167839640d7e624844651cf3b49b567e77d7691df23024ef2

  • SHA512

    86865cdb186276b6b943d4c8ecb73f01a3dd91cc45b19455b56b6efc15ff5b4b66cff2331365a5f8581632bbf96cc0fbfae5c599dedc0b2e439be059504ef375

  • SSDEEP

    6144:fk/RYDggihEyVhhlQVUouNuHMQ6YrT1Z6qn6MSug:kuggihz3qV3WuHtzHB6VB

Score
10/10
gozi5050bankerdaveisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

http://iextrawebty.com

Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      7e2adc1e8273c9662cc51304835805cc31d1a65c5b151789b69e5441cb666465.exe

    • Size

      359KB

    • MD5

      5afca9ef360236eaf6e55b2d8ce114be

    • SHA1

      7d2919aa03a96c91cc4d0724906c572e12a14d75

    • SHA256

      7e2adc1e8273c9662cc51304835805cc31d1a65c5b151789b69e5441cb666465

    • SHA512

      a52ca21d09fb22a85d5c01301f6d07538b1315764c07772ec0eb5c15d20cec5bc592213995d78e5b0f1bd4db41c605dc66057ef6c1043bc176e27c0b795ca2a8

    • SSDEEP

      6144:Lmjuf/Ei1AhA8QZtEH7wjYjjrF5GPKWpnSi97Q/VqMITAWWSlhEszcC:Lbf/P19b47wjYjj6dAAMoH7lhHcC

    Score
    10/10
    gozi5050bankerdaveisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks