Overview

overview

10

Static

static

10

82b427884a...e7.exe

windows7_x64

3

82b427884a...e7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7

  • Size

    53KB

  • Sample

    220201-lzaswsdah4

  • MD5

    da95ea96dc4029e73b292b91e493e9d7

  • SHA1

    11bf7fb66852f2cd4555b0a4b30b42fe7f0c25d9

  • SHA256

    82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7

  • SHA512

    3b3c1b0a9d9d13a439af5946ef1ff5014e1217e7efda9815355103d5bcae3dfc4b2218e7f658355e74c3dc0ecd689fcdb9f730d5d2c6f4b00384e16b662932dd

Score
10/10
gozi_rm3persistence

Malware Config

Targets

    • Target

      82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7

    • Size

      53KB

    • MD5

      da95ea96dc4029e73b292b91e493e9d7

    • SHA1

      11bf7fb66852f2cd4555b0a4b30b42fe7f0c25d9

    • SHA256

      82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7

    • SHA512

      3b3c1b0a9d9d13a439af5946ef1ff5014e1217e7efda9815355103d5bcae3dfc4b2218e7f658355e74c3dc0ecd689fcdb9f730d5d2c6f4b00384e16b662932dd

    Score
    10/10
    persistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks