gozi | dbbff98392ff816656cd6b1e2aeee10e2bd46f5b83ed3a2a4985fb19f754cf4d | Triage

Sharing

General

Target

2148-2-0x0000000000400000-0x0000000000486000-memory.dmp
Size

536KB
Sample

231012-tn6p7ach69
MD5

e2054dc43c6f2e705131c41e746b642b
SHA1

a708655bc96edbb3d45693c60dc9aab3e5d4c3e0
SHA256

dbbff98392ff816656cd6b1e2aeee10e2bd46f5b83ed3a2a4985fb19f754cf4d
SHA512

26ceb1f278acfb3b3ef866126da5a988c03a80488da627e433b6fd6f99d89538e159aea5ff63847affbece0b6843742a5179d842bc15d242dac5ef155dd03cb7
SSDEEP

3072:TrPI5jSu1sgDgfA4D3pF6JLg6l8qtm0TzXDJaqzy7dU5oOSITtyl:zu1sgDGJrpF6WAQyTJzy7dhOSITk

Score

10^/10

gozi 5050 isfb

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

https://avas1ta.com/in/login/

192.121.22.216

http://mimemoa.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  2148-2-0x0000000000400000-0x0000000000486000-memory.dmp
- Size
  
  536KB
- MD5
  
  e2054dc43c6f2e705131c41e746b642b
- SHA1
  
  a708655bc96edbb3d45693c60dc9aab3e5d4c3e0
- SHA256
  
  dbbff98392ff816656cd6b1e2aeee10e2bd46f5b83ed3a2a4985fb19f754cf4d
- SHA512
  
  26ceb1f278acfb3b3ef866126da5a988c03a80488da627e433b6fd6f99d89538e159aea5ff63847affbece0b6843742a5179d842bc15d242dac5ef155dd03cb7
- SSDEEP
  
  3072:TrPI5jSu1sgDgfA4D3pF6JLg6l8qtm0TzXDJaqzy7dU5oOSITtyl:zu1sgDGJrpF6WAQyTJzy7dhOSITk
Score

3^/10
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2