gozi | 00deb73a1738a3b3bfd9504b70775d668581f504481c7f37c20831504f9b77aa | Triage

Submit
Reports

Overview

overview

Static

static

сентя...49.exe

windows7-x64

сентя...49.exe

windows10-2004-x64

сентя...df.exe

windows7-x64

сентя...df.exe

windows10-2004-x64

сентя...5d.exe

windows7-x64

8

сентя...5d.exe

windows10-2004-x64

8

сентя...ba.exe

windows7-x64

сентя...ba.exe

windows10-2004-x64

сентя...bd.exe

windows7-x64

7

сентя...bd.exe

windows10-2004-x64

7

сентя...14.exe

windows7-x64

3

сентя...14.exe

windows10-2004-x64

3

сентя...04.exe

windows7-x64

сентя...04.exe

windows10-2004-x64

сентя...73.exe

windows7-x64

сентя...73.exe

windows10-2004-x64

сентя...4b.exe

windows7-x64

1

сентя...4b.exe

windows10-2004-x64

сентя...ee.exe

windows7-x64

3

сентя...ee.exe

windows10-2004-x64

7

сентя...75.exe

windows7-x64

3

сентя...75.exe

windows10-2004-x64

7

сентя...53.exe

windows7-x64

сентя...53.exe

windows10-2004-x64

сентя...fa.exe

windows7-x64

сентя...fa.exe

windows10-2004-x64

сентя...e3.exe

windows7-x64

сентя...e3.exe

windows10-2004-x64

сентя...3a.exe

windows7-x64

3

сентя...3a.exe

windows10-2004-x64

3

сентя...25.exe

windows7-x64

сентя...25.exe

windows10-2004-x64

Analysis

max time kernel
204s
max time network
404s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:04

Sharing

Static task

static1

general7 vmprotect rat default themida youtubeads mybot hacked aa11 abba nyan cat c2abfb0e7157a4fe8c1096547c466cbb 0da2e3700aa6f05465fdfc323d371488 upx newkrrr home pyinstaller lammer aloshcapz 11 septie office04 darkgate zgrat asyncrat agenttesla redline sectoprat dcrat njrat chaos warzonerat quasar vidar raccoon mimikatz stealc privateloader risepro merlin eternity kutaki lumma empyrean xworm

45 signatures

Behavioral task

behavioral1

Sample

сентябрь 2023(570)/00053bf64ec3040b73c84979799768dba9a03c5f0d2f73512977c7030e29dd49.exe

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

сентябрь 2023(570)/00053bf64ec3040b73c84979799768dba9a03c5f0d2f73512977c7030e29dd49.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

сентябрь 2023(570)/00985db874d9177de4a18999f7a420260b3a4665ba2b5b32aa39433ef79819df.exe

Resource

win7-20231215-en

darkgate general7 stealer

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral4

Sample

сентябрь 2023(570)/00985db874d9177de4a18999f7a420260b3a4665ba2b5b32aa39433ef79819df.exe

Resource

win10v2004-20231215-en

darkgate general7 stealer

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

сентябрь 2023(570)/0110e1c3c1bd79626a55e770490d4ceba396e907c4cff4ec8d7c7293f6915e5d.exe

Resource

win7-20231215-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

сентябрь 2023(570)/0110e1c3c1bd79626a55e770490d4ceba396e907c4cff4ec8d7c7293f6915e5d.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

сентябрь 2023(570)/018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe

Resource

win7-20231215-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

сентябрь 2023(570)/018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral9

Sample

сентябрь 2023(570)/01e5ebc2c096d465800660a0ad6d62208a5b2b675e3700f3734fac225b1d38bd.exe

Resource

win7-20231215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

сентябрь 2023(570)/01e5ebc2c096d465800660a0ad6d62208a5b2b675e3700f3734fac225b1d38bd.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

сентябрь 2023(570)/01fc4ee8bd9cd9c2ee70ccd486f4f3d1fdd42f40fffc6ab66e9f3973f2000e14.exe

Resource

win7-20231215-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral12

Sample

сентябрь 2023(570)/01fc4ee8bd9cd9c2ee70ccd486f4f3d1fdd42f40fffc6ab66e9f3973f2000e14.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

сентябрь 2023(570)/0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe

Resource

win7-20231215-en

vidar 569c252f73517f386dcc9086d37bc4ab stealer

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral14

Sample

сентябрь 2023(570)/0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe

Resource

win10v2004-20231215-en

vidar 569c252f73517f386dcc9086d37bc4ab stealer

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral15

Sample

сентябрь 2023(570)/0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe

Resource

win7-20231215-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

сентябрь 2023(570)/0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

сентябрь 2023(570)/036db747914ccb896aa34f6c58f9f7b2343fb031c2fef98558925526941ad74b.exe

Resource

win7-20231215-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

сентябрь 2023(570)/036db747914ccb896aa34f6c58f9f7b2343fb031c2fef98558925526941ad74b.exe

Resource

win10v2004-20231215-en

xworm rat trojan

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral19

Sample

сентябрь 2023(570)/045cbc9ff518aa3bf58f568868c326af3ea7dea491e2543233885ecbaec30eee.exe

Resource

win7-20231215-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral20

Sample

сентябрь 2023(570)/045cbc9ff518aa3bf58f568868c326af3ea7dea491e2543233885ecbaec30eee.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral21

Sample

сентябрь 2023(570)/057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe

Resource

win7-20231215-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

сентябрь 2023(570)/057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral23

Sample

сентябрь 2023(570)/0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53.exe

Resource

win7-20231215-en

gozi 5050 banker isfb trojan

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

сентябрь 2023(570)/0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

сентябрь 2023(570)/05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa.exe

Resource

win7-20231215-en

smokeloader backdoor trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral26

Sample

сентябрь 2023(570)/05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa.exe

Resource

win10v2004-20231215-en

smokeloader backdoor trojan

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral27

Sample

сентябрь 2023(570)/0651c1ebd22042c0f18964dcf445e7b4f350b2d7d01413040860a2187fdea5e3.exe

Resource

win7-20231215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

сентябрь 2023(570)/0651c1ebd22042c0f18964dcf445e7b4f350b2d7d01413040860a2187fdea5e3.exe

Resource

win10v2004-20231222-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

сентябрь 2023(570)/07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe

Resource

win7-20231129-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral30

Sample

сентябрь 2023(570)/07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe

Resource

win10v2004-20231222-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral31

Sample

сентябрь 2023(570)/0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe

Resource

win7-20231129-en

agenttesla keylogger spyware stealer trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral32

Sample

сентябрь 2023(570)/0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe

Resource

win10v2004-20231215-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

16 signatures

150 seconds

Report Analysis Logs

General

Target

сентябрь 2023(570)/0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53.exe
Size

243KB
MD5

8fc19309b5cea833bcd32517aef20e6c
SHA1

6e2e8cab3c4dfe75f99d12cf9cff7fd9ce322a34
SHA256

0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53
SHA512

34033761eb90f87e48a9edfd93819f3e1bffeb9a32f6504c76dc70de78521f6ff57b4ad1121d7eb9149df0d30d10db653fcde8ae7d94340a488682c8f0f314ff
SSDEEP

3072:5W1+KQuqZdPACX/VIlBuPMVEOqFo67UFMQBzttxq8i7u5s5cPSPTrbp:52c9Z5AOVAEPUEOq5UqCwyP0TJ

Score

10^/10

gozi 5050 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

netsecurez.com

whofoxy.com

mimemoa.com

ntcgo.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Processes

C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53.exe
"C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53.exe"
1⤵
PID:268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-0-0x0000000000220000-0x0000000000235000-memory.dmp

Filesize
84KB

Download
memory/268-1-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/268-2-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/268-3-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/268-4-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/268-5-0x00000000002F0000-0x00000000002FD000-memory.dmp

Filesize
52KB

Download
memory/268-8-0x0000000000220000-0x0000000000235000-memory.dmp

Filesize
84KB

Download
memory/268-9-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download

© 2018-2024

Terms | Privacy