Overview

overview

10

Static

static

3

058d1a8bce...84.exe

windows7-x64

10

058d1a8bce...84.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    058d1a8bce641c7ec149a1ffc71611b45d72dc3493d5ddf29eece71e4d9c6d84

  • Size

    173KB

  • Sample

    241219-yc5qzaxrbt

  • MD5

    b2e77c322bfb16845c90c5a1ada5dc9d

  • SHA1

    696993009f0c8737c5c04445a59696ca0ca5742f

  • SHA256

    058d1a8bce641c7ec149a1ffc71611b45d72dc3493d5ddf29eece71e4d9c6d84

  • SHA512

    39e76a90aad55e0f5e752bbce1dfce817f60a3173bff193e490994f6fb80ec6ae0f8ef32ef128ff98505570b508f797df099f3a504a2d735a4c7a627ddf49110

  • SSDEEP

    3072:o3QwHHZekLlcbo6xjfIWFymNdlRJs7KkRf+1mU39CLHm7UU:4pEsqDIjmNdjJs7Dfc9Cgb

Score
10/10
gozi3490bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214085

Extracted

Family

gozi

Botnet

3490

C2

google.com

gmail.com

wngtdpablo.com

hclement28.com

d33ounorbertoui.top
Attributes
  • build

    214085

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      058d1a8bce641c7ec149a1ffc71611b45d72dc3493d5ddf29eece71e4d9c6d84

    • Size

      173KB

    • MD5

      b2e77c322bfb16845c90c5a1ada5dc9d

    • SHA1

      696993009f0c8737c5c04445a59696ca0ca5742f

    • SHA256

      058d1a8bce641c7ec149a1ffc71611b45d72dc3493d5ddf29eece71e4d9c6d84

    • SHA512

      39e76a90aad55e0f5e752bbce1dfce817f60a3173bff193e490994f6fb80ec6ae0f8ef32ef128ff98505570b508f797df099f3a504a2d735a4c7a627ddf49110

    • SSDEEP

      3072:o3QwHHZekLlcbo6xjfIWFymNdlRJs7KkRf+1mU39CLHm7UU:4pEsqDIjmNdjJs7Dfc9Cgb

    Score
    10/10
    gozi3490bankerdiscoveryisfbtrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks