gozi | 344d7a38a7ef1c0964eff67f4400e01e02e4a79ae76dce3ee1d93e6153715ac1 | Triage

Sharing

General

Target

2064-2-0x0000000000400000-0x0000000000486000-memory.dmp
Size

536KB
Sample

231012-jaq3gaga87
MD5

347192b1d778f04ef5edf72246f3a1ac
SHA1

7062112e890393dc3719f3bd9b4deee87435cd4d
SHA256

344d7a38a7ef1c0964eff67f4400e01e02e4a79ae76dce3ee1d93e6153715ac1
SHA512

c1bedb38894cbe4494974698a35ceda0c633b353745efdbd05dfd74f0bcc0c372fbf50035df673d1b379acd3f7a4ca6b5e13ed202fb5b6f0d41f130e6b34ba34
SSDEEP

3072:TrPI5jSu1ngDgfA4D3j+6XrgGHT4SW4NsnGC4EN/kMBsupYX9c5ofSTtyl:zu1ngDGJrj+6JHT4+WlkgQLfSTk

Score

10^/10

gozi 5050 isfb

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

https://avas1ta.com/in/login/

192.121.22.216

http://mimemoa.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  2064-2-0x0000000000400000-0x0000000000486000-memory.dmp
- Size
  
  536KB
- MD5
  
  347192b1d778f04ef5edf72246f3a1ac
- SHA1
  
  7062112e890393dc3719f3bd9b4deee87435cd4d
- SHA256
  
  344d7a38a7ef1c0964eff67f4400e01e02e4a79ae76dce3ee1d93e6153715ac1
- SHA512
  
  c1bedb38894cbe4494974698a35ceda0c633b353745efdbd05dfd74f0bcc0c372fbf50035df673d1b379acd3f7a4ca6b5e13ed202fb5b6f0d41f130e6b34ba34
- SSDEEP
  
  3072:TrPI5jSu1ngDgfA4D3j+6XrgGHT4SW4NsnGC4EN/kMBsupYX9c5ofSTtyl:zu1ngDGJrj+6JHT4+WlkgQLfSTk
Score

3^/10
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2