Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-09-2024 13:20
General
-
Target
27a54ac6664ee9e26e6f662339f26a604ea919441b610ac06dd03288eaac7b96.exe
-
Size
293KB
-
MD5
9be542d7066e3923dced6d6eef402197
-
SHA1
d3328ad369fd13bd525e9aad8a45e0f340865305
-
SHA256
27a54ac6664ee9e26e6f662339f26a604ea919441b610ac06dd03288eaac7b96
-
SHA512
d66ff4090f255302a093ffc4bbbbc6cd9ba8f3cb8aaf1d708cea0a76a2a696899e31cb1cb8f164b55df283a8d42004c50a2226e526548815cff8e0773cb9035a
-
SSDEEP
3072:QHgkbYK7vhDaEcb3b0LEyMZZAqKjYA+fvrRmso7HHZzBd1zot:+5Y8vhr+3ILEyM9KcA8rRm/H7zo
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
mifrutty.com
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\27a54ac6664ee9e26e6f662339f26a604ea919441b610ac06dd03288eaac7b96.exe"C:\Users\Admin\AppData\Local\Temp\27a54ac6664ee9e26e6f662339f26a604ea919441b610ac06dd03288eaac7b96.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
60KB
-
Filesize
52KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
60KB
-
Filesize
30.6MB