Overview

overview

10

Static

static

10

ca2739a95e...2b.exe

windows7-x64

10

ca2739a95e...2b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ca2739a95ea87229d087f8e1a7f89118745f7b43c5946d580bdf898fdb35622b.zip

  • Size

    33KB

  • MD5

    74a0a09ac5d3edeead25440f0fb754cc

  • SHA1

    5c0865dbca536247eb00b30a35625d47013a36f3

  • SHA256

    02f760d5b1320785fdeef7ed337add2b65fa61bdad0c8577c62aa66f9b836a2f

  • SHA512

    31f7ec0c9913a7a0320aba7b5c8d0b5a6ef74076bcbe9be96216d1705020ecfe5ee2778c86a265987101b88267564d74ddf25bd2e248906548d8cdb9901c0faf

  • SSDEEP

    768:tntb4BoIo0YX5wLs73oiVPWveYAOt4W/dQS:Lkp4uiVUsudQS

Score
10/10
isfb700gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

700

C2

uelcoskdi.ru

iujdhsndjfks.ru

isoridkf.ru

gameindikdowd.ru

jhgfdlkjhaoiu.su

reggy506.ru

reggy914.ru
Attributes
  • base_path

    /uploaded/

  • build

    250257

  • exe_type

    loader

  • extension

    .pct

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ca2739a95ea87229d087f8e1a7f89118745f7b43c5946d580bdf898fdb35622b.zip
    .zip

    Password: infected

  • ca2739a95ea87229d087f8e1a7f89118745f7b43c5946d580bdf898fdb35622b
    .exe windows:5 windows x86

    Password: infected

    1640d668d1471f340cbe565fe63522f6


    Headers

    Imports

    Sections