General
-
Target
pres1642.zip
-
Size
725KB
-
Sample
210915-zdz3jseccp
-
MD5
361a0e3c13303e22c42651bbdd97f011
-
SHA1
363207d32822edca745e42c028c88b5c8ebff8f5
-
SHA256
5eaa391593432a22119e53e5fd2ff6e7ba2f29fc41a370ab128704623a2d43cf
-
SHA512
ae15d48079a1f8a44242c3c5dbe28e2969b6ceda836d239869999c132b1975d8a232fa5a4ac65556bb7b5c6166b16838b8f61d642df47090b8bd2425ebaec8e9
Static task
static1
Malware Config
Extracted
gozi_ifsb
1500
atl.bigbigpoppa.com
pop.urlovedstuff.com
-
build
250211
-
exe_type
loader
-
server_id
580
Targets
-
-
Target
2.bat
-
Size
5B
-
MD5
53f31a089339194f333d2e3995dbb05e
-
SHA1
d929c82d2ee727ccbea9c50c669a71075249899f
-
SHA256
86b0c5a1e2b73b08fd54c727f4458649ed9fe3ad1b6e8ac9460c070113509a1e
-
SHA512
d6f0e8c65e1fe60e81be2aee69b09b9a5df7519dff082cc4e51a705fb044a34db7198b40d480df0a048e32a7d2cf0c4090d64af123a5d852c21c8a35de4ff3fc
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
-
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
-
Blocklisted process makes network request
-
Loads dropped DLL
-