Overview

overview

10

Static

static

10

2964-2-0x0...ry.exe

windows7-x64

1

2964-2-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2964-2-0x0000000000400000-0x0000000000486000-memory.dmp

  • Size

    536KB

  • MD5

    94d23ca97b54ff119af4eacd2fd3d7b4

  • SHA1

    a977664a28af6f5e53381da4ae88fe13518b67f0

  • SHA256

    d06d17c55bcfa13a61c0f519e655ae08a1303635e666c5b5206707b62acada0c

  • SHA512

    4597a8ea26bfd387d1a32acc9db30a5407fa77fd6134254c58cf1a77ba27c7d432fd5ce9f61089f0b8d2dd48d9cc6a83ffdf953aee8b13f5d92ec384c506fa0f

  • SSDEEP

    6144:zu1FgDGJrF+64zIMHQRWsZA0DlgCx0Tk:aEKf+64NHqZAqlH8

Score
10/10
isfb5050gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

https://avas1ta.com/in/login/

192.121.22.216

http://mimemoa.com
Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2964-2-0x0000000000400000-0x0000000000486000-memory.dmp
    .exe windows:5 windows x86


    Headers

    Sections