Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11-05-2024 05:08
General
-
Target
2024-05-11_5332c0a59e1fbee2a7897c2a9dea9b3d_magniber.exe
-
Size
15.9MB
-
MD5
5332c0a59e1fbee2a7897c2a9dea9b3d
-
SHA1
48e81304a02be2eada884d9bc8bc44b2aafebf16
-
SHA256
65b790b69a022c8a968515fd8a535ff7785c885e56868f306171a63bd611bbb3
-
SHA512
70a52983f234e23c36fc6bb9e091bbbbc566cccca6caab311c89b9e6f3f6c80de270a14f7c90fa4887b57c185b076e59b25ef3416b3af7918816af1cf1d23f17
-
SSDEEP
393216:jgMdJwI3saK5c54u2srOQYiclgeOco9t/:jJL3Bu/QYisOH/
Score
10/10
Malware Config
Extracted
Family
gozi
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_5332c0a59e1fbee2a7897c2a9dea9b3d_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_5332c0a59e1fbee2a7897c2a9dea9b3d_magniber.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.0MB
-
Filesize
4KB
-
Filesize
16.1MB
-
Filesize
16.1MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
16.1MB