General
-
Target
00a6659355525272bce8845b6db89d2d9f89e6b96bd5379292ebfebf9cbbe68e
-
Size
270KB
-
Sample
220209-spnqbsaga7
-
MD5
381feeb21f6f2ac230ef7f54c0e7c338
-
SHA1
2a8a1fd121e7af4de8b967b4e6e83330d49c919d
-
SHA256
aebc340869b051f2f2b819d87b00c8b168274100bd650d7f2a04f487b06a8c81
-
SHA512
3a889858ab3053f0365e84eb510fe2885027c2ff550f9fee670e17c3550c6ae663a5c57ac7e3c7a5b040828506695d1f4b9fa1cbb6fed74131ee1403a73cde99
Static task
static1
Behavioral task
behavioral1
Sample
00a6659355525272bce8845b6db89d2d9f89e6b96bd5379292ebfebf9cbbe68e.dll
Resource
win7-en-20211208
Malware Config
Extracted
gozi_ifsb
7612
securezzalink.top
securezzalink.space
linkspremium.ru
premiumlists.ru
-
base_path
/drew/
-
build
250225
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Extracted
gozi_ifsb
7612
premiumlines.top
premiumliner.top
premiumline.space
linespremium.ru
linespremium.pw
blogerslives.com
blogerslines.com
blogspoints.com
blogspoints.ru
filmspoints.com
-
base_path
/images/
-
build
250225
-
exe_type
worker
-
extension
.avi
-
server_id
50
Targets
-
-
Target
00a6659355525272bce8845b6db89d2d9f89e6b96bd5379292ebfebf9cbbe68e
-
Size
490KB
-
MD5
08bd4c8bd321cb906c9275d0231f57b3
-
SHA1
08f3b0f78e0c26898eca40792d499162b13a6036
-
SHA256
00a6659355525272bce8845b6db89d2d9f89e6b96bd5379292ebfebf9cbbe68e
-
SHA512
15023399a0df8bb361aeac6795553c19e1fe7f8f80d1386d48bfb1cd280741349e8e0eeb0cd57bf1b044e0aa5984415afff4905fff4bb2ffc369c418ed1637dd
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-