General

  • Target

    ursnif-worker.bin

  • Size

    178KB

  • MD5

    29e6375ec2569aef3abc372f7a952b6f

  • SHA1

    306411fe775887d8b247312a53e062564856fbe9

  • SHA256

    7d028cd4c5fc29ddbf202584573034a92ebd6265261b306a063553d38862cce7

  • SHA512

    61d6ed9fdd1c1bd01888912bee0968f16f4b9be5212525e73c0ad5f9964532694aa5d3cdb3b9ec6024de049e55a02374010978314766bb6b3e279b386b99c059

  • SSDEEP

    3072:pB8R1zFVm5Af/ux4VOaC5Yph6e9L+l4zEAmBQ6ut0OudCUcF2f0s+cXP:uzKOfBVsYp8Pl4zEAqQ6ut0OuFcO+

Score
10/10

Malware Config

Extracted

Family

gozi

Attributes
  • build

    250260

  • exe_type

    worker

Signatures

  • Gozi family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ursnif-worker.bin
    .dll windows:5 windows x86

    aa4e7746d212e2ec3803b158ab36fe4e


    Headers

    Imports

    Sections