General
-
Target
68cf9929733e3e2c29517eaf13f0ff1876f0576c9142a58e18cefae29bca1585
-
Size
258KB
-
Sample
241221-vfgxjatnel
-
MD5
828fcbb40326aea50c8bc11dcfdc717a
-
SHA1
3b887388db66f7fa4144ef6294eaac5606a05853
-
SHA256
68cf9929733e3e2c29517eaf13f0ff1876f0576c9142a58e18cefae29bca1585
-
SHA512
25ddc2bdc3376b9c2dc7302868a7bfc6286bd2779dedc5d5d5a2a9b0b604933dd70759d637077beaac27a6388446ce2834093cd73bdeb6f6485fd04614f5e6e0
-
SSDEEP
6144:HzUWdXWEO3CFUf0SpcSUfiUoRTQyxghlWMHf2N9Hw:QaCCFUcSYfiUoRTQy4lWMHeN2
Malware Config
Extracted
gozi
7221
po3p53334.yahoo.com
web.citylimitshog.com
-
build
250154
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
Extracted
gozi
Targets
-
-
Target
394ecd747f9b75d73b9d9fb0e393c754ce030e1cccf6c2544fd6eb54578cd517.dll
-
Size
396KB
-
MD5
d832f5a807170a8ef0f436810a58e2cb
-
SHA1
4a6de46a421915bfc08a3c3f2e30a791132606ec
-
SHA256
394ecd747f9b75d73b9d9fb0e393c754ce030e1cccf6c2544fd6eb54578cd517
-
SHA512
14c93518b16a8b34dbb297e9a8bdacbee2ec70985e851618eb8a8c2c8a9f34cfe759d372750cb75e237be37b31fccf72847e61b72cd93d2fb306a703e6d59170
-
SSDEEP
12288:4XxrsWwDQ6tsZgFi43nrxHIS/zjtp23T:4Xxrs9M6tsA1db/zj323
Score10/10-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
-