Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 22:28
General
-
Target
af01d12df06f34e81f3772a1b661eef4f9086a73d953ea1c92a8408c4efa2e77.exe
-
Size
293KB
-
MD5
8c79a57ed866e5382f054567bb4dcd6a
-
SHA1
a3418e0724691c5d103238004f8ed546d560e5c4
-
SHA256
af01d12df06f34e81f3772a1b661eef4f9086a73d953ea1c92a8408c4efa2e77
-
SHA512
49eb95f1748854a3dc846f35df02ed2dbff64b29732bd248f91bbb693256ad3ff9eb5a41b07eca789982392152ff6535a0e33f06646683eb8c182f77191d4c80
-
SSDEEP
6144:1lJBbCGiQedkMGM37T2iG+wBvAKLVqbNqb2:zbDidyMGs7w+w5jLVqZ
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
7621
C2
forumlines.top
linkspremium.ru
premiumlists.ru
Attributes
-
base_path
/drew/
-
build
250225
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
Processes
-
C:\Users\Admin\AppData\Local\Temp\af01d12df06f34e81f3772a1b661eef4f9086a73d953ea1c92a8408c4efa2e77.exe"C:\Users\Admin\AppData\Local\Temp\af01d12df06f34e81f3772a1b661eef4f9086a73d953ea1c92a8408c4efa2e77.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
52KB
-
Filesize
952KB
-
Filesize
1024KB
-
Filesize
52KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB