Overview

overview

10

Static

static

10

2964-2-0x0...ry.exe

windows7-x64

1

2964-2-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2964-2-0x0000000000400000-0x0000000000486000-memory.dmp

  • Size

    536KB

  • Sample

    231012-jeyywagd86

  • MD5

    94d23ca97b54ff119af4eacd2fd3d7b4

  • SHA1

    a977664a28af6f5e53381da4ae88fe13518b67f0

  • SHA256

    d06d17c55bcfa13a61c0f519e655ae08a1303635e666c5b5206707b62acada0c

  • SHA512

    4597a8ea26bfd387d1a32acc9db30a5407fa77fd6134254c58cf1a77ba27c7d432fd5ce9f61089f0b8d2dd48d9cc6a83ffdf953aee8b13f5d92ec384c506fa0f

  • SSDEEP

    6144:zu1FgDGJrF+64zIMHQRWsZA0DlgCx0Tk:aEKf+64NHqZAqlH8

Score
10/10
gozi5050isfb

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

https://avas1ta.com/in/login/

192.121.22.216

http://mimemoa.com
Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      2964-2-0x0000000000400000-0x0000000000486000-memory.dmp

    • Size

      536KB

    • MD5

      94d23ca97b54ff119af4eacd2fd3d7b4

    • SHA1

      a977664a28af6f5e53381da4ae88fe13518b67f0

    • SHA256

      d06d17c55bcfa13a61c0f519e655ae08a1303635e666c5b5206707b62acada0c

    • SHA512

      4597a8ea26bfd387d1a32acc9db30a5407fa77fd6134254c58cf1a77ba27c7d432fd5ce9f61089f0b8d2dd48d9cc6a83ffdf953aee8b13f5d92ec384c506fa0f

    • SSDEEP

      6144:zu1FgDGJrF+64zIMHQRWsZA0DlgCx0Tk:aEKf+64NHqZAqlH8

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks