General
-
Target
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a
-
Size
333KB
-
Sample
221125-nwj89she6y
-
MD5
91f61c4a45f95f9a3dff57b88c767281
-
SHA1
0c10a806bf70c939f1c3a184b0be11dae97082bf
-
SHA256
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a
-
SHA512
e63e3ff71ff0b353ad335ae735907d73f2a2a64466a299270c2903043a792094c6a19013eb5828576908afc2a3920a28fb3c58ed8953079360ec2d9910eeeb5a
-
SSDEEP
6144:ubCa5e8wuDkSW5/koD0KUw00LiT1z22X2:+5e9ykSW5/kkUwKt2
Static task
static1
Behavioral task
behavioral1
Sample
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a.exe
Resource
win7-20220901-en
Malware Config
Extracted
gozi
Extracted
gozi
1010
organfriandpopul.su/bbr_src/utilites/xxx
alrthesecuritywith.su/bbr_src/utilites/xxx
circumstanceshave.su/bbr_src/utilites/xxx
-
exe_type
worker
Targets
-
-
Target
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a
-
Size
333KB
-
MD5
91f61c4a45f95f9a3dff57b88c767281
-
SHA1
0c10a806bf70c939f1c3a184b0be11dae97082bf
-
SHA256
6084cd13efde3d92fa87679755922c889ce6f097f9507f0f8b02855b49ef4f6a
-
SHA512
e63e3ff71ff0b353ad335ae735907d73f2a2a64466a299270c2903043a792094c6a19013eb5828576908afc2a3920a28fb3c58ed8953079360ec2d9910eeeb5a
-
SSDEEP
6144:ubCa5e8wuDkSW5/koD0KUw00LiT1z22X2:+5e9ykSW5/kkUwKt2
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-