General
-
Target
61b85f75e6a7c.dll
-
Size
1.7MB
-
Sample
211214-k7xf7afea6
-
MD5
26788bdf519813ff2600570a5c8e23d9
-
SHA1
44f22a053e84cd7afcf34a4fa19dbf512c8a624d
-
SHA256
25f74513f1f0a72453bf096337daba7268bf77371f7fc210f56672f52b7b3af1
-
SHA512
54cad6bdd1ef350a02e6e3645db3fc3f1fadb385c7dcf5eeacf20a8b1d7fbc42aa3cb88d320fda63a7224b2507e7b84e3942cb54fb61cc398800ec95f6f2d505
Static task
static1
Behavioral task
behavioral1
Sample
61b85f75e6a7c.dll
Resource
win7-en-20211208
Malware Config
Extracted
gozi_ifsb
8899
microsoft.com/windowsdisabler
windows.update3.com
berukoneru.website
gerukoneru.website
fortunarah.com
assets.msn.com
http://microsoft.com
79.110.52.217
79.110.52.215
45.9.20.190
45.9.20.128
aerukoneru.site
serukoneru.site
yerukoneru.site
karfaganda.com
-
base_path
/tire/
-
build
260222
-
dga_season
10
-
exe_type
loader
-
extension
.eta
-
server_id
12
Targets
-
-
Target
61b85f75e6a7c.dll
-
Size
1.7MB
-
MD5
26788bdf519813ff2600570a5c8e23d9
-
SHA1
44f22a053e84cd7afcf34a4fa19dbf512c8a624d
-
SHA256
25f74513f1f0a72453bf096337daba7268bf77371f7fc210f56672f52b7b3af1
-
SHA512
54cad6bdd1ef350a02e6e3645db3fc3f1fadb385c7dcf5eeacf20a8b1d7fbc42aa3cb88d320fda63a7224b2507e7b84e3942cb54fb61cc398800ec95f6f2d505
-
Deletes itself
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-