Analysis
-
max time kernel
26s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-07-2022 03:41
Static task
static1
Behavioral task
behavioral1
Sample
48489bdf70a3009fb6733475f86bd395131f2679739bceadc793d3c0f48db660.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
48489bdf70a3009fb6733475f86bd395131f2679739bceadc793d3c0f48db660.exe
-
Size
203KB
-
MD5
9c77e354edaa63399878fb26917e0675
-
SHA1
bf8dc82abd44fa193575d4134be5846c8fc6f308
-
SHA256
48489bdf70a3009fb6733475f86bd395131f2679739bceadc793d3c0f48db660
-
SHA512
928cd28087dd5b7e6722a73fd4c9fd6205629e34b2013cd2ee17098bf8c4ab9fadae1e82f9e9caad1a0e54e1993ce4731190b73ce8e14fd3afdee4b2ff56e7c6
Malware Config
Extracted
Family
gozi_ifsb
Attributes
-
build
215165
Extracted
Family
gozi_ifsb
Botnet
3162
C2
menehleibe.com
liemuteste.com
thulligend.com
Attributes
-
build
215165
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/892-54-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/892-56-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/892-55-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/892-57-0x00000000002F0000-0x000000000030B000-memory.dmpFilesize
108KB
-
memory/892-60-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB