General
-
Target
1196-56-0x0000000000400000-0x000000000044C000-memory.dmp
-
Size
304KB
-
Sample
230308-h4xxfaeb5v
-
MD5
4a2c7f9367341470bb9a064c40c25893
-
SHA1
6f1a80a991c52cd8274b43597eb3b7692b2782b3
-
SHA256
d4363db314f0f421aaf7edfa336cc9d1f6a342162b0393cdfbb4a76591e48c28
-
SHA512
bae0bd2b904761d316804a87ee9f63053e8667dd9347ca886f46bda34f9b7b3f665e4d78670396507c1dce04e9d83b2663ab1a7e92d2f08817d3d9ead9f81872
-
SSDEEP
3072:VfKWrNoVUE3Hn5PcN6ugTCIKmO8YUAWDE/Rp9QpFGH52c:RKWrOVUuGNYDlO8YI4Zp9Qz
Behavioral task
behavioral1
Sample
1196-56-0x0000000000400000-0x000000000044C000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1196-56-0x0000000000400000-0x000000000044C000-memory.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
gozi
Extracted
gozi
7711
checklist.skype.com
62.173.138.6
89.117.37.146
46.8.210.82
89.116.227.15
31.41.44.51
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Targets
-
-
Target
1196-56-0x0000000000400000-0x000000000044C000-memory.dmp
-
Size
304KB
-
MD5
4a2c7f9367341470bb9a064c40c25893
-
SHA1
6f1a80a991c52cd8274b43597eb3b7692b2782b3
-
SHA256
d4363db314f0f421aaf7edfa336cc9d1f6a342162b0393cdfbb4a76591e48c28
-
SHA512
bae0bd2b904761d316804a87ee9f63053e8667dd9347ca886f46bda34f9b7b3f665e4d78670396507c1dce04e9d83b2663ab1a7e92d2f08817d3d9ead9f81872
-
SSDEEP
3072:VfKWrNoVUE3Hn5PcN6ugTCIKmO8YUAWDE/Rp9QpFGH52c:RKWrOVUuGNYDlO8YI4Zp9Qz
Score3/10 -