General
-
Target
4448.exe
-
Size
307KB
-
Sample
201128-3wh7ga76va
-
MD5
3ba71636ccecaedce74887a8744f47f5
-
SHA1
628a557f8952bac80acccf5fb5a110ca7957a40f
-
SHA256
f0477a54192fcb83e719cab38b6ba9e12c677d37ba5b2ea20051ebbf3c9c3995
-
SHA512
d16a2aa6a453ff47093c1249a7ef14f8cb2cc6d928f13fb1db1773c5b351f6e76b4e709a93da094ef4b481c69f272d94cb946d5a36e007a1bf24cee1ab1571d7
Static task
static1
Behavioral task
behavioral1
Sample
4448.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
4448.exe
Resource
win10v20201028
Malware Config
Extracted
gozi_ifsb
4448
web.vortex.data.microsoft.com
ocsp.sca1b.amazontrust.com
89.249.65.165
-
dga_season
10
-
dns_servers
107.174.86.134
107.175.127.22
-
exe_type
worker
-
server_id
12
Targets
-
-
Target
4448.exe
-
Size
307KB
-
MD5
3ba71636ccecaedce74887a8744f47f5
-
SHA1
628a557f8952bac80acccf5fb5a110ca7957a40f
-
SHA256
f0477a54192fcb83e719cab38b6ba9e12c677d37ba5b2ea20051ebbf3c9c3995
-
SHA512
d16a2aa6a453ff47093c1249a7ef14f8cb2cc6d928f13fb1db1773c5b351f6e76b4e709a93da094ef4b481c69f272d94cb946d5a36e007a1bf24cee1ab1571d7
Score10/10-
Deletes itself
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-