General
-
Target
1.zip
-
Size
926KB
-
Sample
210831-vavc48avz6
-
MD5
c0a52467b3f55ea2b7496b1f8b14bbf1
-
SHA1
a21dc0f481b202e68850b921ced92231b87216fd
-
SHA256
d71a262c0993dd076f8bd0b7d0a596524cf8c6a6fd7eaf638f580abf2714441f
-
SHA512
80b23cef412d2914ce2d9c749ff586e2186d3ca7137525a7f4c2e3abf315d4c4987070ff661b2e4714cac22d3f401ef8cdd461aae5c7ce19a915a30a4869c83b
Static task
static1
Malware Config
Extracted
gozi_ifsb
1500
f1.bablefiler.at
f22.avanoruk.com
-
build
250211
-
exe_type
loader
-
server_id
580
Targets
-
-
Target
1.bat
-
Size
5B
-
MD5
53f31a089339194f333d2e3995dbb05e
-
SHA1
d929c82d2ee727ccbea9c50c669a71075249899f
-
SHA256
86b0c5a1e2b73b08fd54c727f4458649ed9fe3ad1b6e8ac9460c070113509a1e
-
SHA512
d6f0e8c65e1fe60e81be2aee69b09b9a5df7519dff082cc4e51a705fb044a34db7198b40d480df0a048e32a7d2cf0c4090d64af123a5d852c21c8a35de4ff3fc
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-