Overview

overview

10

Static

static

10

a17278301c...dc.dll

windows7-x64

1

a17278301c...dc.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a17278301c0bf3525ad25c88335440dc

  • Size

    223KB

  • MD5

    a17278301c0bf3525ad25c88335440dc

  • SHA1

    7a0e4877dde054d545f4efe000181e047e9e8204

  • SHA256

    ce6fd95f85fe4fa57f678974c3690cf829887fb7723de85d3a51e64199b780c7

  • SHA512

    9715c511cc242548d15ceceaf402ef6b576823fb1d496667afb5ca43ca447c46930c989f418c4ad129aa4f516ae239ae5811ea9960d3ac1a583cbfa2cecd312f

  • SSDEEP

    6144:dHExb7VwvtKNbnvSxYNiyf+D3LuDXy5eHQ:Kxb5wvtKRvSxY0G+D7urnQ

Score
10/10
isfb1001gozi

Malware Config

Extracted

Family

gozi

Botnet

1001

C2

updates.esset.com

jensjen.in

strongbilt.cc

drauduburr.ws

besstrown.cn

druckenshtalen.mn

grantedii.co

loudam62.tk

libricee.in

burbasoftw.pw

waiseen.io

trumphujtebevrot.bit

ymxslfmppjcvwkrjtfnr.co

ohnjjxasfxgxiakhtohn.in

hnhccsotdqftyicvossk.at

xcgrdxcmfirfvignnfea.ws

umvwdtbenbinronbohcc.pw
Attributes
  • base_path

    /images/

  • dga_season

    10

  • dns_servers

    107.174.86.134

    107.175.127.22

  • exe_type

    worker

  • extension

    .avi

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • a17278301c0bf3525ad25c88335440dc
    .dll windows:5 windows x64 arch:x64

    a2bba8f9bc87dc77d912b0ff63f31a67


    Headers

    Imports

    Sections