Overview

overview

10

Static

static

10

1980-56-0x...ry.exe

windows7-x64

1

1980-56-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1980-56-0x0000000000400000-0x00000000004AF000-memory.dmp

  • Size

    700KB

  • MD5

    9d51cf9f64902587ddf29b6590408b3b

  • SHA1

    f4080c4045b340d7061306dd68673373ced83a3f

  • SHA256

    828848cc96bbceeaadba8d6c3a0826fd28b2ed478448663e2dbf899361bb023c

  • SHA512

    63090d4526739ae81557d1e9b6f3c76049774c2308134452baa4c8281753366f0d35ad0c94710e2a4bebd7de712267618739798d4df44ac9c3ff38a506549b83

  • SSDEEP

    3072:HA1g0VjtYZ10n02zTGmMAe5BkKoieLe0sNoHFh:g1g0VWr0n0+/pKoJrIoH

Score
10/10
isfb10000gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

10000

C2

https://avast.com/in/login/

http://94.247.42.61

https://avast.com/ibgn/login/

http://185.158.251.39
Attributes
  • base_path

    /front/

  • build

    250259

  • exe_type

    loader

  • extension

    .bak

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1980-56-0x0000000000400000-0x00000000004AF000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections