Overview

overview

10

Static

static

9

dd3eacaf67...66.exe

windows7-x64

10

dd3eacaf67...66.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd3eacaf674626f63b4d2b2bd9965666

  • Size

    461KB

  • Sample

    240325-e7t36sgb85

  • MD5

    dd3eacaf674626f63b4d2b2bd9965666

  • SHA1

    222fa747c652da9bb2d48f8fe7c245ec9fa25b30

  • SHA256

    77f790e2e1ab2a7fe626582261ccd4f8b4897228473ecada18a77c9a2624eff0

  • SHA512

    7283fefade4a5e05607fdb583a3b97487c6ca99408db8b301b8d5426a6398976b0e5bff42662677f579b38d34a553ccb39d59ad514ae1e7851a97f7451f99b98

  • SSDEEP

    6144:otEtEtEtEtEtEtEtEtEtEt9WO2gUXdCpnZavQqR:Ceeeeeeeeee9xwcaN

Score
10/10
gozi89820235bankercryptonepackerrm3trojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    300898

Extracted

Family

gozi

Botnet

89820235

C2

https://exeupay.xyz

Attributes
  • build

    300898

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      dd3eacaf674626f63b4d2b2bd9965666

    • Size

      461KB

    • MD5

      dd3eacaf674626f63b4d2b2bd9965666

    • SHA1

      222fa747c652da9bb2d48f8fe7c245ec9fa25b30

    • SHA256

      77f790e2e1ab2a7fe626582261ccd4f8b4897228473ecada18a77c9a2624eff0

    • SHA512

      7283fefade4a5e05607fdb583a3b97487c6ca99408db8b301b8d5426a6398976b0e5bff42662677f579b38d34a553ccb39d59ad514ae1e7851a97f7451f99b98

    • SSDEEP

      6144:otEtEtEtEtEtEtEtEtEtEt9WO2gUXdCpnZavQqR:Ceeeeeeeeee9xwcaN

    Score
    10/10
    gozi89820235bankerrm3trojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks