General
-
Target
c486d8579308999b7d9f8cbb6de33b7a3976b9db5b98c06b7744adf5d5d11caf
-
Size
196KB
-
Sample
220201-k9ghracadn
-
MD5
c9bd16862ae56ec22ca70e30af4a4c8d
-
SHA1
fa373e7657225b3bf681cbba1021a85b238c127e
-
SHA256
c486d8579308999b7d9f8cbb6de33b7a3976b9db5b98c06b7744adf5d5d11caf
-
SHA512
4467af98ff380fd03abc70270bedd29f1857b78f44e0ac6cb387c745b5e122eb8ed7ef33d5b28f4be4761857047768696a0f97150ef8407dc88484274f92f00a
Behavioral task
behavioral1
Sample
c486d8579308999b7d9f8cbb6de33b7a3976b9db5b98c06b7744adf5d5d11caf.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c486d8579308999b7d9f8cbb6de33b7a3976b9db5b98c06b7744adf5d5d11caf.dll
Resource
win10v2004-en-20220113
Malware Config
Extracted
gozi_ifsb
1500
api10.v8engine.at/webstore
b.in100k.at/webstore
vo5vuw5tdkqetax4.onion/webstore
api12.apgolop.at/webstore
extra.avareg.cn/webstore
d6djf2vtjv5kowow.onion/webstore
foo.up100n.at/webstore
h22.feel500.at/webstore
zq4aggr2i6hmklgd.onion/webstore
free.up100n.at/webstore
b52.mo100.at/webstore
api10.apgolop.at/webstore
-
build
250152
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
550
Targets
-
-
Target
c486d8579308999b7d9f8cbb6de33b7a3976b9db5b98c06b7744adf5d5d11caf
-
Size
196KB
-
MD5
c9bd16862ae56ec22ca70e30af4a4c8d
-
SHA1
fa373e7657225b3bf681cbba1021a85b238c127e
-
SHA256
c486d8579308999b7d9f8cbb6de33b7a3976b9db5b98c06b7744adf5d5d11caf
-
SHA512
4467af98ff380fd03abc70270bedd29f1857b78f44e0ac6cb387c745b5e122eb8ed7ef33d5b28f4be4761857047768696a0f97150ef8407dc88484274f92f00a
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Sets service image path in registry
-