Overview

overview

10

Static

static

10

2228-2-0x0...ry.exe

windows7-x64

1

2228-2-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2228-2-0x0000000000400000-0x0000000000486000-memory.dmp

  • Size

    536KB

  • MD5

    66c77ea456f4294ba5e9f7b959697801

  • SHA1

    22d5ac5d27148a2909d3b49e9a8c4d6782b5275d

  • SHA256

    e0d8aa1dae8ce788f43a913e52d38a3b8ffc1529dfcee3d3b5f2ab6eee95c96d

  • SHA512

    fa65429e818520cbab5de4967bff6ccef48917f87888386dd6add77325a67d5bb17631937522bc159ebcf3ac0c4a5064491131e79e44d395c286bbd35b8f87f0

  • SSDEEP

    3072:TrPI5jSu1YgDgfA4D362oG6Y/JDlvf90PbXP+C7earSQf8aNUJ5Qtud/T0K:zu1YgDGJr62X6YP90PbXP+Cp1Yd/T

Score
10/10
isfb5050gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

https://avas1ta.com/in/login/

192.121.22.216

http://mimemoa.com
Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2228-2-0x0000000000400000-0x0000000000486000-memory.dmp
    .exe windows:5 windows x86


    Headers

    Sections