Behavioral task
behavioral1
Sample
4100-185-0x0000000001130000-0x000000000113E000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4100-185-0x0000000001130000-0x000000000113E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4100-185-0x0000000001130000-0x000000000113E000-memory.dmp
-
Size
56KB
-
MD5
ed86a6db3a9f559ea4443bbfeb6756af
-
SHA1
cf09cd0fd752ac0416d07fe8f52e5f5f31b54aed
-
SHA256
d3997447d737e3016ae1a57d822596d734321a3a82ed1b5dcb2eb17d717f1c63
-
SHA512
777f33e397d920ea86148a9ab1ec4d182a8185b8f9c26d1c76305715c55b7b40af0b5180638b7f170e3bec47a2412e24d6d3e7587b1f7c2721f0ed54e38b7f67
-
SSDEEP
768:1ufLCqkY1oR4jInhpp55dWSlkiidEfUPJqBQPt04:1mCqkLR4jaDtmiuqURq
Malware Config
Extracted
gozi
Extracted
gozi
1001
https://checklist.skype.com
http://176.10.125.84
http://91.242.219.235
http://79.132.130.73
http://176.10.119.209
http://194.76.225.88
http://79.132.134.158
-
base_path
/microsoft/
-
build
250256
-
exe_type
loader
-
extension
.acx
-
server_id
50
Signatures
-
Gozi family
Files
-
4100-185-0x0000000001130000-0x000000000113E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 1024B - Virtual size: 727B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ