Overview

overview

10

Static

static

10

06b2c3b503...a3.dll

windows7-x64

1

06b2c3b503...a3.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    06b2c3b5030eed6705f8fb31360ce3a3

  • Size

    242KB

  • MD5

    06b2c3b5030eed6705f8fb31360ce3a3

  • SHA1

    eb56f9a08540f7ed122a6dd15b90d166cf652c34

  • SHA256

    02d6dffa6d68fc760a18c4efe0a07846d959fe3d15bc9206bb9f0e9e50d207e8

  • SHA512

    ccc5ba8106e6595a22b51950e0adf772e1ab5c86507fbacaa1e7e0b7370d47d73f8ed1df162ea088d8c840295a385467d23c2679ecc78963b8c294784a8e9529

  • SSDEEP

    6144:1mnZO0GDlypHAT/cxkDyPFXkfh+3m33c56Wjak4S3S83xk:1MZOrEpHAT/cLPF0Im3s56WjaCi8u

Score
10/10
isfb3500gozi

Malware Config

Extracted

Family

gozi

Botnet

3500

C2

art.microsoftsofymicrosoftsoft.at

r23cirt55ysvtdvl.onion

fop.langoonik.com

fog.taginoka.at

pop.biopiof.at

l46t3vgvmtx5wxe6.onion

v10.avyanok.com

apr.intoolkom.at

mas.nagonoman.at
Attributes
  • exe_type

    worker

  • server_id

    580

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 06b2c3b5030eed6705f8fb31360ce3a3
    .dll windows:4 windows x64 arch:x64

    8a5d8f502e35131a4443369f6ddb5a6c


    Headers

    Imports

    Sections