Overview

overview

10

Static

static

10

1932-2-0x0...ry.exe

windows7-x64

1

1932-2-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1932-2-0x0000000000400000-0x0000000000486000-memory.dmp

  • Size

    536KB

  • Sample

    231012-qwrpfsed47

  • MD5

    ab5ee80b3e0139522fb6b32cc3925d2f

  • SHA1

    d087e767ee0ffa059f4c34d285e1fefd1318a292

  • SHA256

    a5c1e72304d31dc236fc914dd9463ebeb4eb85ee97bdc38aac9f2db699f7136d

  • SHA512

    596f9fe528f58b4cf57eb0cd4edeb4adaaa75871b619629e8f65323e81905f3ffed9267e4f020c24b015336a530716679905966ea891728c1b7dd3709bc0e18c

  • SSDEEP

    6144:zu1fgDGJrUY9Am/Pupmm70oFRhCM4Iqx/+NT:auK2Y9r3i0KtGG5

Score
10/10
gozi5050isfb

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

https://avas1ta.com/in/login/

192.121.22.216

http://mimemoa.com
Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      1932-2-0x0000000000400000-0x0000000000486000-memory.dmp

    • Size

      536KB

    • MD5

      ab5ee80b3e0139522fb6b32cc3925d2f

    • SHA1

      d087e767ee0ffa059f4c34d285e1fefd1318a292

    • SHA256

      a5c1e72304d31dc236fc914dd9463ebeb4eb85ee97bdc38aac9f2db699f7136d

    • SHA512

      596f9fe528f58b4cf57eb0cd4edeb4adaaa75871b619629e8f65323e81905f3ffed9267e4f020c24b015336a530716679905966ea891728c1b7dd3709bc0e18c

    • SSDEEP

      6144:zu1fgDGJrUY9Am/Pupmm70oFRhCM4Iqx/+NT:auK2Y9r3i0KtGG5

    Score
    3/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks