Overview

overview

10

Static

static

10

2012-56-0x...ry.dll

windows7-x64

3

2012-56-0x...ry.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2012-56-0x0000000000200000-0x0000000000239000-memory.dmp

  • Size

    228KB

  • MD5

    0429ef2e9812a3c4a2479a487042be92

  • SHA1

    91a1a3141ea37a0d5f6a9112919dd17276c7fbc2

  • SHA256

    14ff40a8f7efa25f01d4ae555dd3b8763d9515244d6f926ef079704e8321d1ec

  • SHA512

    7494e82ddba8e87e5270d97ab7ee8900c08c026bb1acfc1947619936f0c08f0f1249cfa1e3e28489afcfaf1ebe285109e5f39eb58d087707cb32599d6311164a

  • SSDEEP

    768:n2SO/YF36DYmSevkcy3cUT0LrqH6EHV9HmDXhVp/s6zTgMlbDlxKWAb2:1O/YF2YmSGeVmHG9HCx/jzTtbBxK

Score
10/10
isfb777777gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

777777

C2

trackingg-protectioon.cdn4.mozilla.net

176.10.111.233

91.241.93.192

45.155.249.200

45.155.250.216
Attributes
  • base_path

    /fonts/

  • build

    250257

  • exe_type

    loader

  • extension

    .bak

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2012-56-0x0000000000200000-0x0000000000239000-memory.dmp
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections