Analysis
-
max time kernel
141s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
11-10-2023 08:34
General
-
Target
client.exe
-
Size
243KB
-
MD5
5443e928a0871e9bc94ea21c7d9afeeb
-
SHA1
750e185524650c7e3c1899f09dd310a32a573bb0
-
SHA256
a2d1e788f4bb4f2d5e78004374b60c39a7208dcc4e8523eca686719d32bedd4d
-
SHA512
f9cd49bb339850e5988edc0e137c7aeee19a80af13f605dbf7154debfad5c95221d74893e60ad5feeba9016d58ef5f0108bf7ab4a5c2615a34a28b97480ab818
-
SSDEEP
3072:5W1+V6j0oC9M4d76cPMjbz9nEDL2kYAs5cKWChTrDP:52nwo0Mo76cPM2DL2t+KWSTH
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
netsecurez.com
whofoxy.com
mimemoa.com
ntcgo.com
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
-
Filesize
44KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
84KB
-
Filesize
44KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
52KB
-
Filesize
296KB