Skip to content
KitploitKITPLOIT
उपकरणएक्सप्लॉइटब्लॉग
Log in
जमा करें
उपकरणएक्सप्लॉइटब्लॉग
जमा करें

हैकिंग, पेनटेस्ट और साइबर सुरक्षा उपकरण आपके सुरक्षा शस्त्रागार के लिए!

Kitploit हैकिंग, साइबर सुरक्षा और पेंटेस्टिंग टूल्स की एक निर्देशिका है। कमजोरियों को खोजने, सिस्टम का विश्लेषण करने, परीक्षण को स्वचालित करने और अपनी सुरक्षा को मजबूत करने के लिए नवीनतम प्रोजेक्ट अपडेट खोजें।

··फ़ीड·संपर्क·गोपनीयता·© 2026 Kitploit

टूल निर्देशिका

श्रेणियाँ

सभी श्रेणियाँ देखें
Loading categories
zeek-gozi-detector — एक Zeek आधारित Gozi बैंकिंग मैलवेयर डिटेक्टर। | Kitploit
उपकरण/GitHubGitHub/corelight/zeek-gozi-detector
नेटवर्क सुरक्षामालवेयर विश्लेषणघुसपैठ का पता लगाना
GitHubcorelight/zeek-gozi-detector

zeek-gozi-detector

एक Zeek आधारित Gozi बैंकिंग मैलवेयर डिटेक्टर।

रिपॉजिटरी देखें
11131 साल पहलेअभी तक समीक्षित नहीं

सबसे लोकप्रिय

सभी देखें →

हमारे समुदाय द्वारा सबसे अधिक उपयोग किए जाने वाले उपकरण खोजें।

सभी उपकरण खोजें

हमारे उपकरणों का संग्रह ब्राउज़ करें

सभी उपकरण देखें →
साझा करें

Gozi Malware Detector

यह Zeek पैकेज Gozi बैंकिंग मैलवेयर गतिविधि का पता लगाता है।

संसाधन:

जिन RAR फाइलों की यह पैकेज तलाश करता है, उन पर निम्नलिखित लेखों में चर्चा की गई थी:

  • https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/
  • https://medium.com/@enyel.salas84/unveiling-the-gozi-infection-detecting-gozi-in-an-active-directory-ad-environment-using-9773baebe25f
  • https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Gozi&threatId=-2147225522
  • https://github.com/mlodic/ursnif_beacon_decryptor
  • https://github.com/0ver-fl0w/ISFB_Tools

इसके अलावा, लंबे base64 एन्कोडेड URL का भी इस पैकेज द्वारा पता लगाया जाता है।

आप Zeek के TSV लॉग पर निम्नलिखित कमांड से भी Gozi गतिविधि पा सकते हैं:``` find /logs -name "http*" | parallel -j 10 zcat {} :::: - | zeek-cut host uri | awk -F '\t' '$2 ~ //(stilak|cook|vnc)(32|64).rar$/ || ($2 ~ /^/\w+/([a-zA-Z0-9/]|/?2/?F|/?2/?B|/?0/?A|/?0/?D){200,}.[a-zA-Z0-9]+$/ && gsub(///, "/", $2) > 10)'

## PCAPs

PCAP स्रोत: https://malware-traffic-analysis.net/2023/07/12/index.html

## उदाहरण लॉग्स:

### gozi.log उदाहरण:```
#separator \x09
#set_separator	,
#empty_field	(empty)
#unset_field	-
#path	gozi
#open	2023-07-24-19-00-13
#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	http_method	payload
#types	time	string	addr	port	addr	port	string	string
1689201023.169002	ClEkJM2Vm5giqnMf4h	10.7.12.121	49799	151.248.117.244	80	GET	/uploaded/8jvrTb2D/c4CxLmogLgZQGC_2FQ_2B2b/Ma3ylmhq8i/MeT_2Fmtq1zDpHZZQ/2OknTIetuvPf/SqlzkcwbzWM/aFx0b70stnXODu/WDQ2wUhiUaYRbirzPbAvc/2V_2Feb1BeDPQaU0/WZs_2FbMUKJ37c4/Gf5YYgB_2B8BS7mcYa/jECotoj7R/7bH1bkdIXbwbqpU0Nryv/_2BfEwnTZ0On333QjdJ/fdFWYGQpQofXObilmWG0P_/2BS5YP7Tcj18X/cQoSxxb6/FYqDyT3sva2N6amcI32HXsv/n6pffb_2FO/UxvFILD91uIk2oNQx/DEmgyRV_2FLi/3pF67pmCpVP/mFnn0G63A1Sv9N/05KeIqFG3zHYuPPOU/1P.pct
1689201024.619787	ClEkJM2Vm5giqnMf4h	10.7.12.121	49799	151.248.117.244	80	GET	/uploaded/IfjXSAQlkk/LWNR4tkuOMiXdy5H_/2F55TZ5Ulkmf/KZSJQNnlKNL/oXNw6o8qzjnHJh/42iAsB5AuQ8n_2FyMP9YN/iAK5Z4rM1kiabXH3/Tbf6F39oZk8a8mY/9CVAQTHkAlTev6Vstr/ir_2FniSr/BvZGpW5mVB5nr9pTRisy/xPxWcp7jW1doRbtDMhT/9qJZuk9sdFnLKTsj12Ald9/3B3TYfDuu18i7/7LNZfim3/7nt5T5HqNSKfJKcDB7vJpeR/BoPpPolfrA/Z_2F56SDXpQJw4TYJ/45pcw80raC9d/yeDiXFQDftm/RIxazSR_2BPJ0F/wL6l8KasDC6CAzVNLSL_2/F535_2BDNH1/tcGkkEMCZrS/i.pct
1689201025.545122	ClEkJM2Vm5giqnMf4h	10.7.12.121	49799	151.248.117.244	80	GET	/uploaded/MsY1SyBRpp3LKx93fMeITx/w33QoEW7tSfHh/8_2Fqcx1/mAOJzt3teF4AUCrc8IBMkbm/8laKdMc_2F/A0s_2B6tfYEvyAcP_/2Bk_2Buvkjcq/80G4xrhnFAN/TCW76WZrbPDSMY/_2FhKbl7f8pmHGBET0Y_2/BvcMUzja7B7xdYYK/qwpg5fbrMu6AsJ8/Dejh0cXcFfYe8h75Yx/Fn3LZFhMy/29bQzFKZyZHoHgfyV1XJ/Lw1D14ehZUiPYfQxTWv/LlBNcxqMhthgso7PYl8tLq/JhO8H_2FKdEez/1uHkLyhp/SD1X5u0VHgJvzUkDhpUUhKb/Q6cyGyHP3A/UPnKN8bJKuY7qHpRC/r94GeIuEWP3a/G9Zo2.pct
1689201032.086164	C4J4Th3PJpwUYZZ6gc	10.7.12.121	49800	151.248.117.244	80	GET	/uploaded/DjeJ0blPQ/_2BkfrDEoFQgD04wO2F7/Ojqqobto35jEVZ1IQyU/G7zu4_2BFUfhIMJcKkibbg/fjjRaEElICvmR/e5DoJnsG/vsx3T8eOiuXp0AlWknwttvf/A_2FrNprrb/bHnMsv4916Q0BUf_2/B3XIECBmUK_2/FW3G5XPXaPV/ySf6P_2BIXQe7C/q0IvZNIlHZt2c8lCjnMGY/BP81zPWMMzAUn3VS/Y_2BCg7CLJsM0vz/MloZ0Th38yNZOadE6L/qwrs9PKza/13Lw9jqWnbyh08rIXwcG/mMM0HdBwcj6NPi6_2FH/5qnQe2GM1T/ZuHEvxYT/j.pmg
1689201032.792223	CtPZjS20MLrsMUOJi2	10.7.12.121	49801	91.199.147.95	80	GET	/vnc32.rar
1689201033.823106	CtPZjS20MLrsMUOJi2	10.7.12.121	49801	91.199.147.95	80	GET	/vnc64.rar
1689201045.338855	C4J4Th3PJpwUYZZ6gc	10.7.12.121	49800	151.248.117.244	80	POST	/uploaded/3lFSQwjxUfg8HgrTtqSS/ZKopMRdt0Jtv6ehOunO/ppBgdtF3YUX5Co9W0vX2OQ/UNZWu2BHmWHLi/4Pta3IUW/h8js8gl66mR4P51kp_2B1rV/l_2BDjFJoW/DhHjLJGFTtgPfY5qz/0jnqt8GbX_2F/M2R1QPMjPhA/1LDVR2FItKJXdJ/1qIKPwGyBNh80d_2BqfF_/2F6OR9A8MzQ8A1Mu/qqkL0hlaa4U4qkx/TrAV_2BpGP_2B6FnQc/TZAppMESi/SnlO5AU6khpDGRiOveBi/R4uVGlbArQZk3cDBamb/rekwL.dib
1689201092.103798	C37jN32gN3y3AZzyf6	10.7.12.121	49804	151.248.117.244	80	GET	/uploaded/2bzPCygywLAsZWyvNxjbcR/cKuODU9uu8UJj/gDXKcy4d/pxB9zipofP8_2BeS_2BpJud/wkj0W_2BrO/D0paOzWNgyCiXYNe9/AsQMoH_2BRJg/GVsPSdgJRiE/zITTWUchGJIQxc/PZZSjCwXGLw7S5vL91vcA/oe3B5CUOEdkQKGto/2ktXW4RVt_2Fmbv/n4_2FHRpBrdDPlZiJh/KmaIFjefC/fI1TDKY_2Fi19DEaFCtf/tbJcxt2An0A0fA6gNH1/boadLZ34ffeu1q1ucG9FKH/EYecNdYZoQk50/PveWZCeq/k53trqCUnPKJ1m5xUDc0yho/XZNF99CD9fsHQ2/HTO0Ek.pmg
1689201102.721168	C37jN32gN3y3AZzyf6	10.7.12.121	49804	151.248.117.244	80	POST	/uploaded/FjEF3XKaILeAQXFS7ZA/6ce9M8T8314qcvkufQ9O3S/JEiYn7jw1hdk_/2FAtv4Vn/N5GtGAMF_2FYvtXXK_2F4Zl/0Y5qJKSmBu/44at7WoJqMtrEfLU4/cCeZclRfpCKD/aqpRqtgj2sE/drWQE_2FO8cplq/lY0zN1yBj_2B61heqRGGa/5HcIhc_2FvLTthv2/zJpeMsgvDci4AdQ/JdEAEDTa1bhGI6VaRH/rQTuBAqF4/MKUC3UIYW2SYFTHwfKtZ/tqpLYYZ1oSbrStWcuxS/OOYuTMB0uaGg4_2Bq0zpwn/Gww.dib
1689201152.062519	CtxTCR2Yer0FR1tIBg	10.7.12.121	49809	151.248.117.244	80	GET	/uploaded/Wbfe_2B11dG116Ncm/nQpZ3IruCPSM/3Lj73LAhcds/M336HbpbJFjPEL/ZgkdjdFIqBCjLtdnX14jQ/pQ5Bv86GIP5te5wH/8b4izrx5O9qiGfp/GRUC2Np0poTRCDkKkc/F1E4cQ1R6/lwssUMXdU1nBa8LCS0k_/2BId7kfbrkQVYBR50Dx/zW_2Bmfzi9fE7K8N9p4LoV/xI2jj2pDdJhUG/_2FG3di0/_2BhPTAOji4t57Awbk_2BoP/FD_2FSdzzj/Oy86TrwY_2BeLaoSb/T3HHtuhn_2Fe/V7LWds_2FAh/JDMBWxJ2ws7_2B/H3SE1djM5W2vA05PIQhD2/cANoEAshNec/AshCNLFh.pmg
1689201152.931165	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/vnc32.rar
1689201154.267014	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/vnc64.rar
1689201212.075480	CqlVyW1YwZ15RhTBc4	10.7.12.121	49812	151.248.117.244	80	GET	/uploaded/2wXajjUK6yQe/Hf4yISpkavj/9iz17_2FpADpqe/FWDEQXEZFDkmT425JjzHt/yyAY_2FjOXJCcbQn/Uawx_2FYMnhoXhg/ibKz0SNEJa5T9jTj3f/6NOt_2Fa5/Ku8TE_2FdlXWmtildKLG/gZiwSpWV6ZG600H5kL3/fgOUNq4SopgajW6DchSOfD/ouyx1xA5AWRmw/H_2FnmjS/_2BFOQbTGn_2FGrFa8mb4aT/1gPcElQ69l/HjKo4TfTciPYAtacn/mMNHAQmFl5oI/k_2BpMEeXvn/EvX7gGlJyfJbja/AEj9oZdnWgTa24IDPHMcK/D_2B7fNjNY3qwhg_/2Bfk_2BexEKG8fb/_2B2V6tJ/Z.pmg
1689201212.545740	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/stilak32.rar
1689201213.629452	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/stilak64.rar
1689201224.113946	CqlVyW1YwZ15RhTBc4	10.7.12.121	49812	151.248.117.244	80	POST	/uploaded/WXSLx9k_2B82HoW2/5_2BLUFBQld8l5T/qSTWooG_2FxVNQE46u/lEUybYtwS/COcE2tivLeuVegwAhJog/faALYpov_2FC8h5u5eO/fw3u8FebEwLjC7EtSs56sq/jeBDFyP8S3aoD/khK6K1bI/hFYNrfXYtNkDgime9sa_2Bf/PexBAh2LNK/x9DDabFXM4vy1FqMl/hiJw0kWrjo17/_2BEcPVh7np/NrWpuoNVXSAumZ/w5HpM98Gc8U_2Fd9mwtWQ/JslZMqJLjs5A2cHb/dPTxBByvm2dlxKs/QZAx0q5BQy/yyQ.dib
1689201272.155278	CLNN1k2QMum1aexUK7	10.7.12.121	49813	151.248.117.244	80	GET	/uploaded/NpXONA6eXmuef0TniOWSt/sbrGBURPDr67_2B9/zugzDGAY9vrWyYE/EoCvKEsas2Wm6zMwGW/cMs90msiF/gnFvn30lzjaZ5h3PdKID/6g64fT4mJRE6B4R9WUT/HKA7lMal5mey_2FPlSOLtm/XhNIsdZRWX2jS/kdCbahFx/NR1EtG6hX9iAZdhHNUXacNX/flRI_2FocO/5pJ6z880JnKjeUa00/au7MK4OJL0GY/Z3ksfmVR9IV/r3UCP3HGpLy_2F/xc5XMCSKRsk8WSBjGbRqu/PGOO7SV5Onm8JPaO/a5E2tVpUMNRT_2B/7iu1sJ94FgCmULIGUx/2xJ8pAqlA/YJI.pmg
1689201272.641361	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/cook32.rar
1689201273.697406	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/cook64.rar
1689201284.289498	CLNN1k2QMum1aexUK7	10.7.12.121	49813	151.248.117.244	80	POST	/uploaded/OAoLm55_2B2OCF/rEWUf7X9OOkiz59zPQg3E/Aj5owhhIbmbWgx54/UV8kPJrYxDAnkrg/OKPbChY4KRO7PEjk_2/B43R3ufTu/uvyMeJAMJmrlIBLpmBfP/L4v_2FB_2BBaG4ladWq/3aMpm2yqqMZXZu3jf_2FVA/VTO_2FUe28w3t/tFzcTS3R/xc7hl9jMM_2BB_2BDIlMD_2/BqSLR5qL96/eKD0WGu5ydPqFhYg_/2BXCIyssztxU/cq9urrcafTw/mSgYrRpEyTyV0z/jbJLU8aVKuIk3v9MuxmYJ/_2B60trr/CQBxcRJ_2B/c.dib
1689201341.330163	CiyBAq1bBLNaTiTAc	10.7.12.121	49814	151.248.117.244	80	GET	/uploaded/7chaPmanW7OMxzoNzJHScgR/EHmxsmATVa/jTfmCcJ6135be0wkb/Hg9peWe_2FuD/DggTpUxGdAt/a_2Bgx78GlYrfc/oijiGdGd1d8ljosgBQQti/4TwXqFBIUG941OT2/VKCQX023FLHkcvB/1b1mWR2MFml0MzW54N/ENj7AuThp/zdzvrxl2cpTy7sAtXYGN/FABQ17R4mAyxhHDee1G/1y87US30E6nykjpjJWy5b_/2BNhvSOgcLNRS/gmeCK_2F/_2FStMa4HGsB_2Bc5R6IDNr/rcWw1GvShf/DGf_2BhMmSqTsvWDQ/iJGrX9Z6avCeA/Iy.pmg
टूल डाउनलोड करें