General
-
Target
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac
-
Size
388KB
-
Sample
220724-decgzscfb3
-
MD5
87e6bfe8246e3a4f050f4e19db909985
-
SHA1
e61b8afaff9a929a78fee1195977e9b275566694
-
SHA256
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac
-
SHA512
3482e5ab3be2f036c2edfc80d9645a9a8ce0a1d1c865ce6b1b7b56404ba623f529a2fac04052131182b5d70b4129e0b8209fbea62521ad9cf61520cdfb3ba26b
Static task
static1
Behavioral task
behavioral1
Sample
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Targets
-
-
Target
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac
-
Size
388KB
-
MD5
87e6bfe8246e3a4f050f4e19db909985
-
SHA1
e61b8afaff9a929a78fee1195977e9b275566694
-
SHA256
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac
-
SHA512
3482e5ab3be2f036c2edfc80d9645a9a8ce0a1d1c865ce6b1b7b56404ba623f529a2fac04052131182b5d70b4129e0b8209fbea62521ad9cf61520cdfb3ba26b
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-