gozi | 26c02d5dc45bcf6bc0acc97b5efe4fc5771dd69222387547bd56a8b73d0d48b5

Sharing

Copy URL Twitter E-mail

General

Target
xworm-3.1-modded-v1.0.1.7z
Size 24.4MB
Sample260826-l23axscf69
SHA256 26c02d5dc45bcf6bc0acc97b5efe4fc5771dd69222387547bd56a8b73d0d48b5
MD5 968c1dd71bcffb8b9a6e12698b159c3f
SHA1 e46d730e93575a8863dfc623a0ba35d9b07f1147
SHA512 d3640efea788d6c7cda27bf65c1897488e823e5a7d40e7d57ea16ddef47832ac34c4562ffb54cd7356868fd0ce60630fe3ca7e33392d34ab1cc31e055377f299
SSDEEP 786432:LRnpgbD+4aM3pbJ2ZdXxhdevmrgDj/2PIBifmknEjZ2IQkc:zgbD+XWn2ZnPImrzdfmkEjakc
TLSH
T1264733FEF6E262D428D959C87F6646074C815AE2F9AF444BC1FB0FC0A9D1B80BDA045D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gozi

Targets

- Target
  xworm-3.1-modded-v1.0.1.7z
- Size 24.4MB
- SHA256 26c02d5dc45bcf6bc0acc97b5efe4fc5771dd69222387547bd56a8b73d0d48b5
- MD5 968c1dd71bcffb8b9a6e12698b159c3f
- SHA1 e46d730e93575a8863dfc623a0ba35d9b07f1147
- SHA512 d3640efea788d6c7cda27bf65c1897488e823e5a7d40e7d57ea16ddef47832ac34c4562ffb54cd7356868fd0ce60630fe3ca7e33392d34ab1cc31e055377f299
- SSDEEP 786432:LRnpgbD+4aM3pbJ2ZdXxhdevmrgDj/2PIBifmknEjZ2IQkc:zgbD+XWn2ZnPImrzdfmkEjakc
- TLSH
  T1264733FEF6E262D428D959C87F6646074C815AE2F9AF444BC1FB0FC0A9D1B80BDA045D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Mods/MetroFramework.Fonts.dll
- Size 656KB
- SHA256 e96030fddaf7e78401567ee82480ad75ee48d3556199a3f85c0ec669edac2ef4
- MD5 612080028164b12939751dcccbb68d4a
- SHA1 db066593c63d2eff41a5af1b49a3e098b60e0013
- SHA512 1879c960e27e32941c0c992b84803e7a1f8d243bfc88d17d3d32baca772290b9ea60a6ea90d53170be3bf7f0a58fe71ec901dc66aa560b4bf68b1da56c09fe18
- SSDEEP 12288:H+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:H+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- TLSH
  T1BDE429B5760139E6EF11C4B7C260FD80192B7863A77B802A68E3077A88575CDFE53E46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Mods/MetroFramework.dll
- Size 149KB
- SHA256 baf326f52d39155d722465947f4cc67e6e90cfd0f89954eab959568e9bc342aa
- MD5 44538b311e9ec2bcf0a6452702628d99
- SHA1 da67301539903775708e9ec913654851e9e8eade
- SHA512 b65e3bc1c0f7b4c8f778cf52a36d628301d60aab53fdaf0355163e4865bc3d3adbf8870bb6cefc604708fdf2c0e72258eaf2fe301d524af2f77bc08014c9610a
- SSDEEP 3072:LU0T+erz8jYxYg5lzrPHlMUzxXd4kRZPI9q:vT+erz8jYxYgv/lxXGWPS
- TLSH
  T139E33B21770D457FC6BF4A7AF0A12492C3B0DC51FA7BDF5D5C82A29C989B794AE01283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Mods/NordTheme.dll
- Size 7KB
- SHA256 2852c69bb28e9bf2ef5f9525eb5bb8dd216987d12488d333b4e8a799d6d834ed
- MD5 7ee4da7091658fd753deac2dc73fb955
- SHA1 06ed08cee6279ca4fa01b42b3356cb4074fe1ead
- SHA512 2b30a1d61f40b8bf9b9536f28ffa2b4f22ec0a7b25339576b587c25d5004b1341db59293c8c31c79b2d7ff497b4f5c9b3a22417388d70efebaaeb90a4cb142e5
- SSDEEP 96:v/rXKe7pEpejkb8MEu5bT8oznGw+3CqfeXDXNa5zlr:7XKWk2kbfhb/+V205xr
- TLSH
  T13FE16034ABF9CF74D9B7463478FB1A401AFD6A089A21F7690CC604DA0CD1E063B21B65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Mods/downloader.dll
- Size 2.0MB
- SHA256 9da3bfbf8716467b10890e3047f7a5c5b114fc8dfb1e1be3d0c60ec81258cd44
- MD5 87beaa21a40598b34c905c5b4e7ba0e0
- SHA1 29730918e3770791ee7259e8853128274f1a04ef
- SHA512 40977c1444a7f55120c589d601b74d6e329e630dd528c73b560959372b594a6ba99f350673ee6bc745e89c227a5bd07c80cac88be2929571304094bdf3446529
- SSDEEP 24576:4dDrPRfjmR7G2ZnVCQjkmyLr84kTcN+3x+4BQhcrSDr6hTp/th0JTL:mrJKR5nVCQjkX84+cN+3EZg/th0JT
- TLSH
  T17AA53AC6E218E445273629EDBB3203DDE60BC52F01A52A59B90E8DEC6F3E4441794E7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  NAudio.dll
- Size 502KB
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH
  T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Plugins/ActiveWindows.dll
- Size 14KB
- SHA256 5679768b449a8e59b5a9ad8eb6e9fcd7e03c70869da8fd7b6cec5e948aac56b1
- MD5 abf694ddb10c63e5205444b442e49706
- SHA1 8d9d2beba8240b2795b6113db9a158219e63ffeb
- SHA512 63c44c10b88f2a2655887a93b1f4b2288f99d2ae3622ff7f62a9edf4ff9325ebb66e16215572fe896e46fc335364b203f632124e9409b9f863189306a9499f30
- SSDEEP 384:IqIGejCUccJeGCJWM2YFegdT8Ft0Y7XZ316DMz:IqIGeXcWrCJ+EtYZ316Du
- TLSH
  T14B620755E3E54331C6FE1AB34C7323401B70C2099C53FB1E4EDC6096AF63A9986957BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Plugins/All-In-One.dll
- Size 4.8MB
- SHA256 effaa01f092dda8351e6f4a4a1bc651acf91865a4f512a3a336b7e6fea495bda
- MD5 8b462f2be3497eb66347a6047180d759
- SHA1 601974b1547653fa38f84a5e2b6cef1d4a4214ca
- SHA512 6fb8226192277cfda113805154cf83c01590db1b159add775d21db0101b8c5b45847ceef27f105d0275b1b1dc692cc5774f7777795ae8e832301836bed5d4843
- SSDEEP 98304:nl19F9QORkChiDC9OtH7c2iwGxIvPBOw0JefVfQ2a5cFd4KssODtd:z9FPRkC8C9OH7c2ilInz0kfVo26Wsd
- TLSH
  T1953623187FE18717F9EF97F1D5A2420A9BF4E053B356E79F5E9484E9388230089222D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Plugins/Chat.dll
- Size 18KB
- SHA256 185efd0dda1032e4e738b674877bb2c0de931b02f69057d6ee00914f9b8f6db7
- MD5 a25cbb61fadacf30d8e4b638c097d30b
- SHA1 ba3ba796c8dfc5e802179c1a85ebdaab0ed35c78
- SHA512 7dc53503402c69e9d659de45993ceffdf61824d853eb55fda921469f683df2f6ba44f76ec1462d5614a8cafd95e976615d4cd94e28c068eed22e56ed5ab67826
- SSDEEP 384:zUeLD8aDbXCtSeEd3uq7uQZRHUrwTKvt0GIKoIDfiUWGfZ:+kbCtSeE5uq7uQYr0HIDfiX6
- TLSH
  T102823A2DA395C3F2C6FD2BF64C72928107B1D221DE03FF2A9ECC946A9DA37854644785
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Plugins/Clipboard.dll
- Size 14KB
- SHA256 6e6d2010f02c4a2b8372ed98728e68d740d262df05be811942e26229f21af1b9
- MD5 3873c7a085d349ee7d80f19a1d04466a
- SHA1 df563f40438603db051e97ba5d15b8d064eaa918
- SHA512 12a806f5f035c69fe4ed3859cb42e1441924185d40c23c026a57ce052c9a4060bc1d5fb7d289db4d94be093fbb763075cd667c6db5aee3541defd076c5163b2d
- SSDEEP 192:kAXyVpJlyIxlioHESRJ29u+6ZWSYASO3tOXXgNTen1i9iY6IW1mX/60/jAqEM7RL:kXVpuoHpMDfAR98STe1oi2X/6xMrwU
- TLSH
  T148523B59B3D44339C6EE1AB21C7392800774D715AC13FF2E2CD8A0B15DAB6D58762BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Plugins/FileManager.dll
- Size 27KB
- SHA256 4da7b92dd81ff96931aa9012eabaa0878d13c78dc3cd840b102ce7e15fec4b7b
- MD5 35e01d48dc293c1ee38fb76a001fc6fd
- SHA1 36b5ec73b188bed24e8549f1f9244acc89e2ecc7
- SHA512 210260c3802c21a48f84bc5c865d4b8fd804258d160ca8d20032e32650f4e197a650463e6cb56e7b459b6043046be17b146d26a4ee41b0e215c842ba5ecf6cd3
- SSDEEP 384:tp4K215dISbc/TY0mN1PGDQXSBJVYol/tF37enOAkxqb8cq/hsutzgk/b7oBxkpE:h21vWk0yPGsXAr7dtRKPb8V3dmjC0b
- TLSH
  T131C22BAE3BD08211D5FE89B2497295080730EA039823FF5E7DC4359E9E33AD64A107F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Plugins/FileSeacher.dll
- Size 478KB
- SHA256 1d97563568c011b93d3149bfd062d81647b1ccb9ab87b270e39a518d108f77d1
- MD5 f7bea87f295d1d4284ae396a822950a0
- SHA1 d8c7bdac70c147dfc1432b6794a821d9b07d720a
- SHA512 8061d47255769a398d4a1f608260c211de4be71d3475d4284f0df881b371de172cc334f323ad4bb9d702ceac6de0ae700f3006d9c2e383bd41f1742d0ae8b2e9
- SSDEEP 6144:zPv5T5fIIC8W8XqeGtSV41QJDsTDDh0Yhe6dwxLV/vuhgS0mkdwcG:znfIICLlS4Ys50ie6CfigSjE
- TLSH
  T139A48D406BE8C657F1BF27B6C4F262A0C7B0E465A52EDB8F5D4024EE2D17340E9117AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Plugins/HRDP.dll
- Size 1.7MB
- SHA256 52ebcc3cd12ee6ce2274cc289386beb7a9dc31a4a2b583dbab5495b67b32ca27
- MD5 144178b1a4f5e6b19b01a272d29a2f0b
- SHA1 0af94d62ac2e0c9db3f9d7054382c5226efd21f5
- SHA512 928b0dd4c9cc0c4edb8d64acdc6dd8e9c92951af2bd218ffd0f5991109133b4b30bdbabe4f4762b8d14f9c15ecde716404cfc036ece4d7b2d6db159428ad7fb9
- SSDEEP 24576:brKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:6HZ5pdqYH8ia6GcKuR7
- TLSH
  T1B5851918F6D8423ED857D2359A7153B2D7FAB9482F20738A2928075A7F2B3D02B3575C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Plugins/HVNC.dll
- Size 58KB
- SHA256 8918b5549441692917ab504e1ad9455d8e62eff189becadee048e6c1493d1bbb
- MD5 9dfed469828dc9a5ec89e3cd21d5b74a
- SHA1 8422ba84ef565ad495958249bc940b527e9c9460
- SHA512 ce8bdb7e820c3d910c3a6232552e2a576a4c03cc128dd6d4eba5b48f3b1ff397e0abc9918e0f08d550962b81e69dfb3cab579a2ac81e2c57658da2c35a9be9f8
- SSDEEP 1536:8SheTaT7z12BWR74mdItPighZ+7YvgxBFQ:jheTKz12BWR76BhbynQ
- TLSH
  T180434A4567E58A31E1FE0F76887397108771F2635913EB0E1BC5A0A96FA33828651BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Plugins/Informations.dll
- Size 22KB
- SHA256 88569d549e184ef63f2c2ae4e3c3adc9d957296b6a67cf0ee94287d681cc0934
- MD5 da772b035ae5b347de1b17e2e24463dc
- SHA1 5ba3cdaf6e33c58cfd8ccecbe14310a035e00523
- SHA512 ba396154e899dca31312ab9e2a14682aed0a51b5d45db4b0c72efad5cd74767c5bde2bf90099bd886a52adcdf8abb66ff16dcd992ed6a7598ce49e3afaa95922
- SSDEEP 384:DnQf5APE80e6vkD7RQQpOJXWn3TmoNhxJNSOFD45fZ41:DnQfGPEOD7vcJKj3NSRZQ
- TLSH
  T104A21A98B3E44265D1FE2AB30872904513B6F70B9D13FA2D1EC8919E4D73784CA54BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32