Overview

overview

10

Static

static

1

94.exe

windows7-x64

10

94.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94.exe

  • Size

    288KB

  • Sample

    240528-q1s33sgh67

  • MD5

    35eb15db22e26d961d4151afeedbe67a

  • SHA1

    754923d156367f31bdd67a990c36d517f54f8c95

  • SHA256

    94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f

  • SHA512

    11e036654d7361ed7ce94529569faaac196a647316509618f400f2819a45b09d2e0c35f34bb3e7356c6f747d9297671177c4439664de631d540ffe3fc29d0bc2

  • SSDEEP

    6144:5QCAmQFgNUpGijhKHGke/TaHUMhn0RM6BfKuTtmaJepw9Eg9o6r:uCAmQFgqRhKM/ninLgfKuTkkXEg9oQ

Score
10/10
gozi4780bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214084

Extracted

Family

gozi

Botnet

4780

C2

microsoft.com

avast.com
Attributes
  • build

    214084

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      94.exe

    • Size

      288KB

    • MD5

      35eb15db22e26d961d4151afeedbe67a

    • SHA1

      754923d156367f31bdd67a990c36d517f54f8c95

    • SHA256

      94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f

    • SHA512

      11e036654d7361ed7ce94529569faaac196a647316509618f400f2819a45b09d2e0c35f34bb3e7356c6f747d9297671177c4439664de631d540ffe3fc29d0bc2

    • SSDEEP

      6144:5QCAmQFgNUpGijhKHGke/TaHUMhn0RM6BfKuTtmaJepw9Eg9o6r:uCAmQFgqRhKM/ninLgfKuTkkXEg9oQ

    Score
    10/10
    gozi4780bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks