General
-
Target
2.zip
-
Size
661KB
-
Sample
210907-tt9n2achf7
-
MD5
0945c7a360147543584905342b1a4af9
-
SHA1
5f9ab585a96dc29fe084309615004d4c6206c06e
-
SHA256
e93eff9fcefc1e4cff03a218144e16b5632ca85fbf4f9a3ac726d6b1b0b5b256
-
SHA512
8eac84b02199b661382c25b51b03c3800a0aebde635c8fb7b72ff8266efb9aec02295232117681a51e9869ea8710b7042fc291f468a30f09f9ba410acfc1ab9e
Static task
static1
Behavioral task
behavioral1
Sample
1.bat
Resource
win7-en
Malware Config
Extracted
gozi_ifsb
1500
atl.bigbigpoppa.com
pop.urlovedstuff.com
-
build
250211
-
exe_type
loader
-
server_id
580
Targets
-
-
Target
1.bat
-
Size
5B
-
MD5
53f31a089339194f333d2e3995dbb05e
-
SHA1
d929c82d2ee727ccbea9c50c669a71075249899f
-
SHA256
86b0c5a1e2b73b08fd54c727f4458649ed9fe3ad1b6e8ac9460c070113509a1e
-
SHA512
d6f0e8c65e1fe60e81be2aee69b09b9a5df7519dff082cc4e51a705fb044a34db7198b40d480df0a048e32a7d2cf0c4090d64af123a5d852c21c8a35de4ff3fc
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-