General
-
Target
readme
-
Size
471KB
-
Sample
220323-ntlz3sdbf4
-
MD5
fbc2f28e187edcc6ddf89989ff8e591f
-
SHA1
a322761d2f8eb898810454f545e8646495e98fea
-
SHA256
77457f0b7da19036041ca3a0071e141909d889eb7e2d28d6ad0df73bc3c81636
-
SHA512
6d04490602f0239dc823a5640793f5415597a70682d64b1620ae5006a351c70e232cb5c024caf2eff2ef2527d22ed321687dcde94b00877f8ecfc9ba788ae0de
Static task
static1
Behavioral task
behavioral1
Sample
readme.dll
Resource
win7-20220310-it
Behavioral task
behavioral2
Sample
readme.dll
Resource
win10v2004-it-20220113
Malware Config
Extracted
gozi_ifsb
7627
vilogerta.top
linkspremium.ru
premiumlists.ru
-
base_path
/drew/
-
build
250225
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Targets
-
-
Target
readme
-
Size
471KB
-
MD5
fbc2f28e187edcc6ddf89989ff8e591f
-
SHA1
a322761d2f8eb898810454f545e8646495e98fea
-
SHA256
77457f0b7da19036041ca3a0071e141909d889eb7e2d28d6ad0df73bc3c81636
-
SHA512
6d04490602f0239dc823a5640793f5415597a70682d64b1620ae5006a351c70e232cb5c024caf2eff2ef2527d22ed321687dcde94b00877f8ecfc9ba788ae0de
-
Registers COM server for autorun
-
Executes dropped EXE
-
Sets file execution options in registry
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-