General
-
Target
c3ae74e9996e1bcbad2818ccf713152ae03a632a50b425573923fb5b15dc7a40
-
Size
956KB
-
Sample
230129-wcz5dafh76
-
MD5
a4d2c581f512fe50aaeb97aa438c233e
-
SHA1
57ef6d9db8eb19c6853f1dd3ea40d95f823b480f
-
SHA256
c3ae74e9996e1bcbad2818ccf713152ae03a632a50b425573923fb5b15dc7a40
-
SHA512
9ed02fa2eaa07ff44b774160a44f44dd489bf4266e45f4b61f63e7e2eae1071e26f389c63330161647d1702b6de869539e94859b195842fc6d83616f189979a9
-
SSDEEP
24576:mOrDG3wBlTQGKG7psOQhbwDk3lc+sv0cnVWezj8Q9gasYWenxvXf+k+7bff663qD:3q8lMGtpsOQhbwDYlc+svvWezoQ9gaPZ
Static task
static1
Behavioral task
behavioral1
Sample
c3ae74e9996e1bcbad2818ccf713152ae03a632a50b425573923fb5b15dc7a40.dll
Resource
win7-20221111-en
Malware Config
Extracted
gozi
Extracted
gozi
1000
http://ey7kuuklgieop2pq.onion
http://maiamirainy.at
http://drunt.at
http://news-deck.at
-
build
216098
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Targets
-
-
Target
c3ae74e9996e1bcbad2818ccf713152ae03a632a50b425573923fb5b15dc7a40
-
Size
956KB
-
MD5
a4d2c581f512fe50aaeb97aa438c233e
-
SHA1
57ef6d9db8eb19c6853f1dd3ea40d95f823b480f
-
SHA256
c3ae74e9996e1bcbad2818ccf713152ae03a632a50b425573923fb5b15dc7a40
-
SHA512
9ed02fa2eaa07ff44b774160a44f44dd489bf4266e45f4b61f63e7e2eae1071e26f389c63330161647d1702b6de869539e94859b195842fc6d83616f189979a9
-
SSDEEP
24576:mOrDG3wBlTQGKG7psOQhbwDk3lc+sv0cnVWezj8Q9gasYWenxvXf+k+7bff663qD:3q8lMGtpsOQhbwDYlc+svvWezoQ9gaPZ
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-