Overview

overview

10

Static

static

10

bf297503bf...23.dll

windows7-x64

1

bf297503bf...23.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9251090fce3ce31a5ca8fbe6d40257859cd262494936379c3192c360b3f6500c.zip

  • Size

    134KB

  • MD5

    f9e75ba71e409d86e7400e2dca68afaf

  • SHA1

    56fc654aad7f987290175eb9da66f51ba3a64c76

  • SHA256

    9251090fce3ce31a5ca8fbe6d40257859cd262494936379c3192c360b3f6500c

  • SHA512

    357c6a25b77e3fd1131f2e50d677f18d9ae7307ed29bc769e517547c8bd9c6e4c4bae927fe84795485d474d17dc2a5ad73c10698cb1310902fa2232fc7358dc9

  • SSDEEP

    3072:Fn9c/kmXAbJicpdM7VjdRfhMFJ9VRnGatGWCGc3aMUccxCo:o/6VJpSVjbpUG0GWCGgagiCo

Score
10/10
isfb1100gozi

Malware Config

Extracted

Family

gozi

Botnet

1100

C2

app.crasa.at/api1

g4xp7aanksu6qgci.onion/api1

hop.feen007.at/api1

l35sr5h5jl7xrh2q.onion/api1

gm.amaroker.at/api1

frls.amarob.xyz/api1

6buzj3jmnvrak4lh.onion/api1

cd1.novand.at/api1

ram.unici.at/api1

wrt.foreklo.at/api1
Attributes
  • build

    250180

  • exe_type

    worker

  • server_id

    730

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 9251090fce3ce31a5ca8fbe6d40257859cd262494936379c3192c360b3f6500c.zip
    .zip

    Password: infected

  • bf297503bf1a01bc698294d1d66c9e58512f557ff452996d2a06344de157b723.exe
    .dll windows:4 windows x64 arch:x64

    ce83b6a6bda7ec04d7f1a2124cee2b13


    Headers

    Imports

    Sections