Behavioral task
behavioral1
Sample
740-132-0x0000000000590000-0x000000000059D000-memory.dll
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
740-132-0x0000000000590000-0x000000000059D000-memory.dll
Resource
win10v2004-20220722-en
General
-
Target
740-132-0x0000000000590000-0x000000000059D000-memory.dmp
-
Size
52KB
-
MD5
282c4f689044fc503a8fec3de97d0bf4
-
SHA1
8c1c0a854f232ed98e4b4895671e7fe2d4be9097
-
SHA256
243e834149bd492d7a08eef87e23c4bd77898089de797fa01bb482c3cc8ddd0a
-
SHA512
64dac858137c02bd0360c11e14025d8cdfb2d5bdfc9d2dea3b70c17d979f979d3c97e7543bfcbce1b1740951af76be3b21c55093045c4dc144500a6246ef5eb0
-
SSDEEP
768:cvEU1jV+vEhLlo9Mof7gHrMfOME5swhf3gpERMN+5uOGQDMR6lvVpC:cF1jVaEhjMa1wpkk+53VDMRyHC
Malware Config
Extracted
gozi_ifsb
11111
trackingg-protectioon.cdn1.mozilla.net
194.76.225.168
194.76.224.242
-
base_path
/fonts/
-
build
250240
-
exe_type
loader
-
extension
.bak
-
server_id
50
Signatures
-
Gozi_ifsb family
Files
-
740-132-0x0000000000590000-0x000000000059D000-memory.dmp.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ