General
-
Target
a00226f3f0c5624b2b4097a7f51c4843ce18b8d242721251060066532d1db8ac
-
Size
822KB
-
Sample
230129-wcmt2sfh67
-
MD5
c7cba63267290dc581b45eee3093a161
-
SHA1
e1f798638461a654d119ead4c3039e2b24ad96b4
-
SHA256
a00226f3f0c5624b2b4097a7f51c4843ce18b8d242721251060066532d1db8ac
-
SHA512
0373a6feacdea506c86cf1607d909e879331f61e8c818ee408a3318f4a53928860cf36a5b998fa4f301b685450c7b63e55b8234f5c013ee1f4eb8b44a6f34437
-
SSDEEP
12288:R4M/vPufq2ORdooOdSgWrdDsXiglWjw9SAcqP2W5OEhuAwc84b2mzd5x6dlGN5:RP3RdNhgWps3UmSSIOKm2mR5xWwN5
Static task
static1
Behavioral task
behavioral1
Sample
a00226f3f0c5624b2b4097a7f51c4843ce18b8d242721251060066532d1db8ac.dll
Resource
win7-20220812-en
Malware Config
Extracted
gozi
Extracted
gozi
1000
http://ey7kuuklgieop2pq.onion
http://news-deck.at
http://taslks.at
http://living-start.at
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Targets
-
-
Target
a00226f3f0c5624b2b4097a7f51c4843ce18b8d242721251060066532d1db8ac
-
Size
822KB
-
MD5
c7cba63267290dc581b45eee3093a161
-
SHA1
e1f798638461a654d119ead4c3039e2b24ad96b4
-
SHA256
a00226f3f0c5624b2b4097a7f51c4843ce18b8d242721251060066532d1db8ac
-
SHA512
0373a6feacdea506c86cf1607d909e879331f61e8c818ee408a3318f4a53928860cf36a5b998fa4f301b685450c7b63e55b8234f5c013ee1f4eb8b44a6f34437
-
SSDEEP
12288:R4M/vPufq2ORdooOdSgWrdDsXiglWjw9SAcqP2W5OEhuAwc84b2mzd5x6dlGN5:RP3RdNhgWps3UmSSIOKm2mR5xWwN5
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-