Overview

overview

10

Static

static

3

5f65108386...26.dll

windows7-x64

10

5f65108386...26.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    715daaef4e3aff08ced8c4d3607d64b119c7d4bac39fb30e9a95cc9137e5b44d

  • Size

    416KB

  • Sample

    241221-wgw9aavpgp

  • MD5

    1a8538ac9bfad49500d1ef282671f175

  • SHA1

    18a8ed67b0a2e4b2b016a0526e8f7baab1cb3885

  • SHA256

    715daaef4e3aff08ced8c4d3607d64b119c7d4bac39fb30e9a95cc9137e5b44d

  • SHA512

    3367b005db20ae70cc08c38386897d73ddc14116b41861db04fe96988df29cb0bb04dd7c49c3fb608746eb2120d2ad58df38fa26be62678ebcf946c3202d15c5

  • SSDEEP

    12288:hVceHeAoQlQtCaryZv1xa83cN0ojE/ArtTyW5nP+:Ae+VtCaGZtg83cmX8yunP+

Score
10/10
gozi7405bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7405

C2

signin.microsoft.com

login.microsoft.com

linerstats.com

linerstats.bar

infeetic.co
Attributes
  • base_path

    /includes/

  • build

    250190

  • dns_servers

    107.174.86.134

    107.175.127.22

  • exe_type

    loader

  • extension

    .img

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      5f65108386662cc4780882e06928dd940ea6c75235bf8e4c09079e6e40045326.dll

    • Size

      744KB

    • MD5

      d6d4942cd0282dbbb0e34276706e6bab

    • SHA1

      90a17a059b290a2d5becbff3ec9fe4dabdfc06ae

    • SHA256

      5f65108386662cc4780882e06928dd940ea6c75235bf8e4c09079e6e40045326

    • SHA512

      ab028fae00d51822e25e38829ee213905d77e6810cad2339e6b2c54530f235596acd749878ef0a65cf10950f40aa4df45c3c7c8d9550add3069c5cd1734f066c

    • SSDEEP

      12288:4GzKiFJSk5OWpk0KQlL7QQDprnF0xfHHlsTRRZC7Emy/Kt28nxub/lgkjK7l6kXC:9+iFJJ5OWpk0KQh8QD8uPZC7EojvkjKa

    Score
    10/10
    gozi7405bankerdiscoveryisfbtrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks