General
-
Target
2ca103eefeb2c579dff1379820596850188eb3a0ca2c08f160a780afedc8c7ba
-
Size
912KB
-
Sample
220614-14l42sfdaq
-
MD5
de9f7c5cd040777d55e2ebe34876b98b
-
SHA1
95675e982578ada0df8a02d7347cfb546a81d273
-
SHA256
2ca103eefeb2c579dff1379820596850188eb3a0ca2c08f160a780afedc8c7ba
-
SHA512
cda3f84199ffb78fe86e0c95c64a3e0a5699328ee88f76092706f05baeff117c18671aafd9e7e98191ee22d213ffa9e2bd68db717da5c4522e25909dd461a7ad
Static task
static1
Behavioral task
behavioral1
Sample
2ca103eefeb2c579dff1379820596850188eb3a0ca2c08f160a780afedc8c7ba.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2ca103eefeb2c579dff1379820596850188eb3a0ca2c08f160a780afedc8c7ba.dll
Resource
win10v2004-20220414-en
Malware Config
Extracted
gozi_ifsb
1000
http://ey7kuuklgieop2pq.onion
http://shoshanna.at
http://maiamirainy.at
-
build
217027
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Targets
-
-
Target
2ca103eefeb2c579dff1379820596850188eb3a0ca2c08f160a780afedc8c7ba
-
Size
912KB
-
MD5
de9f7c5cd040777d55e2ebe34876b98b
-
SHA1
95675e982578ada0df8a02d7347cfb546a81d273
-
SHA256
2ca103eefeb2c579dff1379820596850188eb3a0ca2c08f160a780afedc8c7ba
-
SHA512
cda3f84199ffb78fe86e0c95c64a3e0a5699328ee88f76092706f05baeff117c18671aafd9e7e98191ee22d213ffa9e2bd68db717da5c4522e25909dd461a7ad
Score10/10-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-