Overview

overview

10

Static

static

10

bbdf9b8b0f...a8.dll

windows7-x64

1

bbdf9b8b0f...a8.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    bbdf9b8b0ffc74923d36f152112d26a8

  • Size

    222KB

  • MD5

    bbdf9b8b0ffc74923d36f152112d26a8

  • SHA1

    75649b87458a80f3d8d1eb75f6d68322fd4ceb7d

  • SHA256

    12df68c8de00fc68de68ca402d96e7dfe2effab3fb31359fdd3acea5cd390283

  • SHA512

    6e1edeb323e7dd2f84a743d3fc145289e11dceb5a9f945eedd20287c6e664e18d0b3b6e81df64035a19336f8cbcf28f3664977c57a834791f39a24ff75928775

  • SSDEEP

    6144:/HExb7VwvtKNbnvSxYNiyf+D3Lufy5lH:cxb5wvtKRvSxY0G+D7ufo

Score
10/10
isfb4474gozi

Malware Config

Extracted

Family

gozi

Botnet

4474

C2

lycos.com

mail.yahoo.com

193.56.255.251

193.56.255.250

193.56.255.249

numolerunosell.online

gumolerunosell.online

rumolerunosell.online
Attributes
  • base_path

    /images/

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    worker

  • extension

    .avi

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bbdf9b8b0ffc74923d36f152112d26a8
    .dll windows:5 windows x64 arch:x64

    a2bba8f9bc87dc77d912b0ff63f31a67


    Headers

    Imports

    Sections