Overview

overview

10

Static

static

10

1.dll

windows10-2004-x64

10

1.dll

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1.d
  • Size 39KB
  • Sample260729-j3j5mafb53
  • SHA256 ac10c1b2a72c426c2f032d7da67a7b345b236587c6fb89b6406d8e57cfacb7d9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
gozi5000bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

  • gozi

Extracted

Family

  • gozi

Botnet

  • 5000

C2

  • detectportall.firefox.com

  • 193.242.211.133

  • 185.158.249.215

  • 185.189.151.102

  • 185.219.221.39

  • 194.76.225.96

  • 185.189.151.35

  • 31.214.157.121

  • 185.189.151.34

Attributes
  • base_path

    /archieves/

  • build

    250240

  • exe_type

    loader

  • extension

    .bor

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target
      1.d
    • Size 39KB
    • SHA256 ac10c1b2a72c426c2f032d7da67a7b345b236587c6fb89b6406d8e57cfacb7d9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    banker5000discoverygoziisfbtrojan

    • Family: Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks