gozi | 05935ee9760698045cb5837a94b2b7daa8d9c7597e79762d7b416934220e645a | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-12-2024 11:44

Sharing

Report Analysis Logs

General

Target

2024-12-20_267d5a79fb93bde0016dd98d12710ea9_karagany_mafia.exe
Size

240KB
MD5

267d5a79fb93bde0016dd98d12710ea9
SHA1

86d3c97fdb593c2eecb64f3c2903b4967c19c477
SHA256

05935ee9760698045cb5837a94b2b7daa8d9c7597e79762d7b416934220e645a
SHA512

4f9b17703e920ef34fde93592ec3ae29700ea48fcd233b82d94999cf9bd92416aeda7c4c6ac1d1fd3f15b65b5bf0449cface22a897de6dd6b718bf866a3542a6
SSDEEP

6144:wApIgymzhBtzYvHpLhlxmTY2ErZqXW1PpbB2C:lpIg/tBtYvHpfxmTYRrZ+Wfo

Score

10^/10

gozi banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
214082

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

C:\Users\Admin\AppData\Local\Temp\2024-12-20_267d5a79fb93bde0016dd98d12710ea9_karagany_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-20_267d5a79fb93bde0016dd98d12710ea9_karagany_mafia.exe"
1⤵
PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-0-0x00000000012E0000-0x000000000132D000-memory.dmp

Filesize
308KB

Download
memory/3004-2-0x00000000012E0000-0x000000000132D000-memory.dmp

Filesize
308KB

Download
memory/3004-1-0x0000000001313000-0x0000000001318000-memory.dmp

Filesize
20KB

Download
memory/3004-3-0x00000000012E0000-0x000000000132D000-memory.dmp

Filesize
308KB

Download
memory/3004-5-0x00000000012E0000-0x00000000012EE000-memory.dmp

Filesize
56KB

Download