gozi | 5cf9041ab9e48c6cc245eb7b5e8dddf2440a46fe9e4d23d3241760a0020c395e | Triage

Sharing

General

Target

2336-2-0x0000000000400000-0x0000000000486000-memory.dmp
Size

536KB
Sample

231012-tpsjysaf9w
MD5

22f872e77fa7e62a9f8dd6bf326f8bac
SHA1

0e05ad3614fa0b2cf0747fc413f45bc8b930d7d4
SHA256

5cf9041ab9e48c6cc245eb7b5e8dddf2440a46fe9e4d23d3241760a0020c395e
SHA512

117dc730ef1d8258564db60d6a3c7a5d85ea1f33c32e2a6c275004b13178d11494ebe062accbf990e50424d266f44f86afda2369b82d6900ece6290aeaf273e0
SSDEEP

6144:zu1HgDGJrF+64zIMHQRWsZA0DlgCY0Tk:aCKf+64NHqZAqlq8

Score

10^/10

gozi 5050 isfb

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

https://avas1ta.com/in/login/

192.121.22.216

http://mimemoa.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  2336-2-0x0000000000400000-0x0000000000486000-memory.dmp
- Size
  
  536KB
- MD5
  
  22f872e77fa7e62a9f8dd6bf326f8bac
- SHA1
  
  0e05ad3614fa0b2cf0747fc413f45bc8b930d7d4
- SHA256
  
  5cf9041ab9e48c6cc245eb7b5e8dddf2440a46fe9e4d23d3241760a0020c395e
- SHA512
  
  117dc730ef1d8258564db60d6a3c7a5d85ea1f33c32e2a6c275004b13178d11494ebe062accbf990e50424d266f44f86afda2369b82d6900ece6290aeaf273e0
- SSDEEP
  
  6144:zu1HgDGJrF+64zIMHQRWsZA0DlgCY0Tk:aCKf+64NHqZAqlq8
Score

3^/10
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2