General
-
Target
b245dd6cd46945ef849adf6e11e7125298238d51891778895fb31aae06e9f100
-
Size
241KB
-
Sample
221125-h2n7hsdg6x
-
MD5
bd201f6a7411a44b851194ee1363695c
-
SHA1
377ed077f7b644eb261c222711b82659502b2d67
-
SHA256
b245dd6cd46945ef849adf6e11e7125298238d51891778895fb31aae06e9f100
-
SHA512
2a6b67dade828bb28b5a2169d2d4a383221dc43b1e796353988c6892ebd204c61dee90e025e3a4b4aa398de2b88530ce877bc2eea1e0fae828d04cf38c3aeab2
-
SSDEEP
3072:KCXt3t8uWbNsDMzT00HaJ2W5GinS8f4gj6ErWqQH4DNWUvk5LpnArGxh3T:3NWaDM80HG2+Gr8PzrWTAYUvkphHh
Static task
static1
Behavioral task
behavioral1
Sample
b245dd6cd46945ef849adf6e11e7125298238d51891778895fb31aae06e9f100.exe
Resource
win7-20221111-en
Malware Config
Extracted
gozi
Extracted
gozi
1000
goliathuz.com
musicvideoporntip3s.ru
-
exe_type
worker
Targets
-
-
Target
b245dd6cd46945ef849adf6e11e7125298238d51891778895fb31aae06e9f100
-
Size
241KB
-
MD5
bd201f6a7411a44b851194ee1363695c
-
SHA1
377ed077f7b644eb261c222711b82659502b2d67
-
SHA256
b245dd6cd46945ef849adf6e11e7125298238d51891778895fb31aae06e9f100
-
SHA512
2a6b67dade828bb28b5a2169d2d4a383221dc43b1e796353988c6892ebd204c61dee90e025e3a4b4aa398de2b88530ce877bc2eea1e0fae828d04cf38c3aeab2
-
SSDEEP
3072:KCXt3t8uWbNsDMzT00HaJ2W5GinS8f4gj6ErWqQH4DNWUvk5LpnArGxh3T:3NWaDM80HG2+Gr8PzrWTAYUvkphHh
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-