General
-
Target
image.dll
-
Size
490KB
-
Sample
220209-p35dfsada7
-
MD5
08bd4c8bd321cb906c9275d0231f57b3
-
SHA1
08f3b0f78e0c26898eca40792d499162b13a6036
-
SHA256
00a6659355525272bce8845b6db89d2d9f89e6b96bd5379292ebfebf9cbbe68e
-
SHA512
15023399a0df8bb361aeac6795553c19e1fe7f8f80d1386d48bfb1cd280741349e8e0eeb0cd57bf1b044e0aa5984415afff4905fff4bb2ffc369c418ed1637dd
Static task
static1
Behavioral task
behavioral1
Sample
image.dll
Resource
win7-en-20211208
Malware Config
Extracted
gozi_ifsb
7612
securezzalink.top
securezzalink.space
linkspremium.ru
premiumlists.ru
-
base_path
/drew/
-
build
250225
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Extracted
gozi_ifsb
7612
premiumlines.top
premiumliner.top
premiumline.space
linespremium.ru
linespremium.pw
blogerslives.com
blogerslines.com
blogspoints.com
blogspoints.ru
filmspoints.com
-
base_path
/images/
-
build
250225
-
exe_type
worker
-
extension
.avi
-
server_id
50
Targets
-
-
Target
image.dll
-
Size
490KB
-
MD5
08bd4c8bd321cb906c9275d0231f57b3
-
SHA1
08f3b0f78e0c26898eca40792d499162b13a6036
-
SHA256
00a6659355525272bce8845b6db89d2d9f89e6b96bd5379292ebfebf9cbbe68e
-
SHA512
15023399a0df8bb361aeac6795553c19e1fe7f8f80d1386d48bfb1cd280741349e8e0eeb0cd57bf1b044e0aa5984415afff4905fff4bb2ffc369c418ed1637dd
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-