General

  • Target

    c58fffdd53e1ad2828fc0c96a67d2500

  • Size

    2.9MB

  • Sample

    240313-lssp5acb96

  • MD5

    c58fffdd53e1ad2828fc0c96a67d2500

  • SHA1

    812c69907d5c1cab22bc9772ae04b934cb14a50d

  • SHA256

    35a19200c8ea9694f118cf763cd2fb7f21e99a71000b07e47eb2566fa92d64a9

  • SHA512

    befd3d2dc574388d9e8b54f65805b8eff07181290d610b59910109eab07b042b58c1f3118fe1208371189b21f543b3006890712237b607fd5b958a026cfb0de6

  • SSDEEP

    49152:QB0jzkZIiZnmBTgM2fdHdAl1r7uGloXIk9Baj8BBT4SfcsUjoh48TyMPkXdwkyZ:QB0iZnIc5d9qrdAIkHau42c1joCjMPkK

Malware Config

Extracted

Family

gozi

Targets

    • Target

      c58fffdd53e1ad2828fc0c96a67d2500

    • Size

      2.9MB

    • MD5

      c58fffdd53e1ad2828fc0c96a67d2500

    • SHA1

      812c69907d5c1cab22bc9772ae04b934cb14a50d

    • SHA256

      35a19200c8ea9694f118cf763cd2fb7f21e99a71000b07e47eb2566fa92d64a9

    • SHA512

      befd3d2dc574388d9e8b54f65805b8eff07181290d610b59910109eab07b042b58c1f3118fe1208371189b21f543b3006890712237b607fd5b958a026cfb0de6

    • SSDEEP

      49152:QB0jzkZIiZnmBTgM2fdHdAl1r7uGloXIk9Baj8BBT4SfcsUjoh48TyMPkXdwkyZ:QB0iZnIc5d9qrdAIkHau42c1joCjMPkK

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Matrix

Tasks