Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
11-10-2023 06:10
General
-
Target
26dc3b58f57bf1d28e20374fcc13c33f3bc75bd753cf19afb617101f403f7b81_JC.exe
-
Size
287KB
-
MD5
bbf59fbbb9de660e113d82597c289cff
-
SHA1
85e3f40d8e5e5b93ef0e45e3cb5eec9dd19685be
-
SHA256
26dc3b58f57bf1d28e20374fcc13c33f3bc75bd753cf19afb617101f403f7b81
-
SHA512
8310447870f5de4ae575306391295f205d8ec0e3295f30e8b79e6d65a4e85ad408b0d07859e1c30294c843e5d23ca324d24fb20fe9ddb299dc4ad47d6a24cbfa
-
SSDEEP
3072:j6ya4jStntwsx48m71HMmJn0iZw6vK1ZRQxAgaX6wwrz+UTaBgfUd0:Q4gtTm7+mJnNZfK1ZRHRoJ
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
netsecurez.com
whofoxy.com
mimemoa.com
ntcgo.com
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes
-
C:\Users\Admin\AppData\Local\Temp\26dc3b58f57bf1d28e20374fcc13c33f3bc75bd753cf19afb617101f403f7b81_JC.exe"C:\Users\Admin\AppData\Local\Temp\26dc3b58f57bf1d28e20374fcc13c33f3bc75bd753cf19afb617101f403f7b81_JC.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
-
Filesize
48KB
-
Filesize
60KB
-
Filesize
52KB