Overview

overview

10

Static

static

10

1812-5-0x0...ry.exe

windows7-x64

1812-5-0x0...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1812-5-0x0000000000400000-0x000000000040F000-memory.dmp

  • Size

    60KB

  • Sample

    231011-kvkxmace9x

  • MD5

    ed992b92e41843b6fd5b948d2d0b03d3

  • SHA1

    2b30596204d23d628ba68494cb7126bbbc772421

  • SHA256

    2473959b00d81c81f09b92a5711ed4839073a7516734d3f1d9391aa6ede9f9b9

  • SHA512

    51bb91d1659dce8f16b9b18d1836919406f350de7ed5e80e31144282e62c8364705ac9b00f96acb4b758350151591fc00fbbc5dbe1873ffd7f8f59ebbf7bd0fb

  • SSDEEP

    768:iA3rPI5jShpW1v/xwlZjyY8Kl7aQixYgxYJmv0NHY7lbjNltdX20JC:B3rPI5jSu13aZjLVJaf3C7YJj3HG0JC

Score
10/10
gozi5050isfb

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

netsecurez.com

whofoxy.com

mimemoa.com

ntcgo.com
Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      1812-5-0x0000000000400000-0x000000000040F000-memory.dmp

    • Size

      60KB

    • MD5

      ed992b92e41843b6fd5b948d2d0b03d3

    • SHA1

      2b30596204d23d628ba68494cb7126bbbc772421

    • SHA256

      2473959b00d81c81f09b92a5711ed4839073a7516734d3f1d9391aa6ede9f9b9

    • SHA512

      51bb91d1659dce8f16b9b18d1836919406f350de7ed5e80e31144282e62c8364705ac9b00f96acb4b758350151591fc00fbbc5dbe1873ffd7f8f59ebbf7bd0fb

    • SSDEEP

      768:iA3rPI5jShpW1v/xwlZjyY8Kl7aQixYgxYJmv0NHY7lbjNltdX20JC:B3rPI5jSu13aZjLVJaf3C7YJj3HG0JC

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks