General
-
Target
2b82f8a17838f6b1ef4d441c25d884db12fe0f4eaea082b6d1abfc4bed204c79
-
Size
186KB
-
Sample
220615-cc1lcsfegq
-
MD5
7001c09418df67fcf435dabc4b568731
-
SHA1
680c362c8fdb304b43f6b60b7c0fc176d2d72a89
-
SHA256
2b82f8a17838f6b1ef4d441c25d884db12fe0f4eaea082b6d1abfc4bed204c79
-
SHA512
7163eff9479c913751910b114555775e6a088a4223f55856340fd53f286b55841f3a37c1a57f4958e375edd19ecc9eac8f3e436226f2af600cfcc035e9b98474
Behavioral task
behavioral1
Sample
2b82f8a17838f6b1ef4d441c25d884db12fe0f4eaea082b6d1abfc4bed204c79.dll
Resource
win7-20220414-en
Malware Config
Extracted
gozi_ifsb
2000
api2.doter.at/webstore
beetfeetlife.bit/webstore
in.extermas.at/webstore
d6djf2vtjv5kowow.onion/webstore
asx.zaronif.at/webstore
g2.ex100p.at/webstore
gif.doter.at/webstore
extra.avareg.cn/webstore
vo5vuw5tdkqetax4.onion/webstore
foo.avaregio.at/webstore
op.iovbased.at/webstore
ws.doter.at/webstore
f1.cnboal.at/webstore
zq4aggr2i6hmklgd.onion/webstore
xxx.doolap.at/webstore
-
build
217050
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
dns_servers
51.255.48.78
8.8.8.8
192.71.245.208
178.17.170.179
193.183.98.66
207.148.83.241
111.67.20.8
103.236.162.119
142.4.205.47
213.136.85.253
159.89.249.249
82.196.9.45
-
exe_type
worker
-
server_id
550
Targets
-
-
Target
2b82f8a17838f6b1ef4d441c25d884db12fe0f4eaea082b6d1abfc4bed204c79
-
Size
186KB
-
MD5
7001c09418df67fcf435dabc4b568731
-
SHA1
680c362c8fdb304b43f6b60b7c0fc176d2d72a89
-
SHA256
2b82f8a17838f6b1ef4d441c25d884db12fe0f4eaea082b6d1abfc4bed204c79
-
SHA512
7163eff9479c913751910b114555775e6a088a4223f55856340fd53f286b55841f3a37c1a57f4958e375edd19ecc9eac8f3e436226f2af600cfcc035e9b98474
-