gozi | 80c37568b1e56106f7e434e02adfaa1640aa4c0c4c6ba8a5173d4bf90b8924a6 | Triage

Sharing

General

Target

248420x00000000004000000x0000000000486000memory_JC.dmp
Size

536KB
Sample

231012-svwccsge5v
MD5

ed895efcfbbb3e370755e287d8ae931e
SHA1

3ae8b1f55acd3f3f446044e49bd9f0747ee18a5e
SHA256

80c37568b1e56106f7e434e02adfaa1640aa4c0c4c6ba8a5173d4bf90b8924a6
SHA512

9cd0d8a650c09d8606b6fec0b52f31e0212eef797b66fbae3d066a1478154670afaac53fb1e62fb8e089fa09e1cb93f38f71edfcda85b9859c1790dbc3597122
SSDEEP

6144:zu1zLgDGJrzE651MJd3zk9qpnjEDD5Tk:aWKlE656w9qdjw9

Score

10^/10

gozi 5050 isfb

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

https://avas1ta.com/in/login/

192.121.22.216

http://mimemoa.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  248420x00000000004000000x0000000000486000memory_JC.dmp
- Size
  
  536KB
- MD5
  
  ed895efcfbbb3e370755e287d8ae931e
- SHA1
  
  3ae8b1f55acd3f3f446044e49bd9f0747ee18a5e
- SHA256
  
  80c37568b1e56106f7e434e02adfaa1640aa4c0c4c6ba8a5173d4bf90b8924a6
- SHA512
  
  9cd0d8a650c09d8606b6fec0b52f31e0212eef797b66fbae3d066a1478154670afaac53fb1e62fb8e089fa09e1cb93f38f71edfcda85b9859c1790dbc3597122
- SSDEEP
  
  6144:zu1zLgDGJrzE651MJd3zk9qpnjEDD5Tk:aWKlE656w9qdjw9
Score

3^/10
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2