General
-
Target
31d73b34c44fc4f61e583e3a19e34753d5271de557a5f5a818899f506afc8f99
-
Size
1.1MB
-
Sample
230129-zyxg6aed3w
-
MD5
b602deeb32f8f26326ea16cc78029602
-
SHA1
bad2ea797b9f5b4479f4fe189d6daab35a9a28e9
-
SHA256
31d73b34c44fc4f61e583e3a19e34753d5271de557a5f5a818899f506afc8f99
-
SHA512
90350ba7401f97eea7b990d4d80be25f2fe9233002e6a83efb0fd9f6d04eefca123ed1eb8b5ce8403e762b7f630a1ac3c04a6be8db273850b87d9dbc58b6fcb4
-
SSDEEP
24576:i30ixqmP/+GZgTXrHJB+pffKUmHaRLNW0wfpKncbBWZtxjB/s69ZTGxUcbrJOBPO:i30ixj/aTXrH7+pHKUmHeLNW0wBKnc4a
Static task
static1
Behavioral task
behavioral1
Sample
31d73b34c44fc4f61e583e3a19e34753d5271de557a5f5a818899f506afc8f99.dll
Resource
win7-20221111-en
Malware Config
Extracted
gozi
Extracted
gozi
1000
http://ey7kuuklgieop2pq.onion
http://drunt.at
http://news-deck.at
http://taslks.at
-
build
217107
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Targets
-
-
Target
31d73b34c44fc4f61e583e3a19e34753d5271de557a5f5a818899f506afc8f99
-
Size
1.1MB
-
MD5
b602deeb32f8f26326ea16cc78029602
-
SHA1
bad2ea797b9f5b4479f4fe189d6daab35a9a28e9
-
SHA256
31d73b34c44fc4f61e583e3a19e34753d5271de557a5f5a818899f506afc8f99
-
SHA512
90350ba7401f97eea7b990d4d80be25f2fe9233002e6a83efb0fd9f6d04eefca123ed1eb8b5ce8403e762b7f630a1ac3c04a6be8db273850b87d9dbc58b6fcb4
-
SSDEEP
24576:i30ixqmP/+GZgTXrHJB+pffKUmHaRLNW0wfpKncbBWZtxjB/s69ZTGxUcbrJOBPO:i30ixj/aTXrH7+pHKUmHeLNW0wBKnc4a
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-