General
-
Target
NEAS.4ae472fae99d6aa46e179cc4546ab4b0.exe
-
Size
64KB
-
MD5
4ae472fae99d6aa46e179cc4546ab4b0
-
SHA1
ca6b73ea9257ffea860e8472a06b4eedab5ee68a
-
SHA256
1767ac69dfe318b81181e0f5ed5ebc2386785d2a5028117dfcd0541b7cbcc61e
-
SHA512
a8d7bef15d9ff9b2ade030f2a8f9da6151320cff9ed602047ae4c83d10f4e7a3b34dbb5f20ff602e8085d08b176231a38c1cb109cd54278f6da94b4090d53036
-
SSDEEP
1536:s+8WnrlM3THhV/4e2qlalXpQc1aia5oCLOes:saloBVwe2qlal5naioLLOB
Malware Config
Extracted
gozi
8004
slammagysmanskkapsulrttezya.website
rutramagysmanskkmoderatordstezya.website
rubalasksigysmanlkavayssstezya.website
nalgysmanurmaskmikluhasya.website
gnalmgysmanask4ermanderezya.website
rusitmgysmanaskpikabyatezya.website
rubymgysmanmaskrufinurtdrfezya.website
rufgysmanymrmaskbteyryeuliliezya.website
skumrmgysmanaskihglassdzya.website
rramaskkmigysmanleronurzya.website
rurparagysmanmaskstreptokokusstezya.space
rbabamrgysmanmaskriserdfnstezya.space
runyanmgysmanaskklasgindtezya.space
rurprgysmanamskprikchinhdncstezya.space
sramrmaskgysmanproteploszya.space
glamrgysmanaskdkambibatstezya.space
rutichhdaskgysmanoltogorovidsnstezya.space
rkovkagysmanmasksemyanastezya.adygeya.su
rrakomaskpgysmancdakirgitushkanchikzya.adygeya.su
rzipaurgysmanmaskssmastaezya.abkhazia.su
-
build
250161
-
dga_season
10
-
dns_servers
107.174.86.134
107.175.127.22
-
exe_type
loader
-
server_id
12
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
NEAS.4ae472fae99d6aa46e179cc4546ab4b0.exe
Headers
Sections