General
-
Target
1704-56-0x0000000000400000-0x000000000044B000-memory.dmp
-
Size
300KB
-
Sample
230308-y89pssfg8w
-
MD5
a61baa82346e55a1b0f1fdd1bf47b75b
-
SHA1
58b41b569660a8b8d0d3ca87c8a1753740be3ff8
-
SHA256
d733caf5882c2f18058aa29703e42aa3bed6de60ad771536d77d8aabbf1d542e
-
SHA512
2fa14e9918d987c31aa1d62e86881628265b236d18b5ecb55764336a1a3ff024cccba83c6b1fabddacb8e1c14709bfa4d218875ed946815d3bcb3fced9f9bb3e
-
SSDEEP
3072:VfKprNoVUE3Hn5utOJy6xOAOwk+JpWV9I7C+vaWTqF:RKprOVUu3DOwk+JpWV9oCua3
Behavioral task
behavioral1
Sample
1704-56-0x0000000000400000-0x000000000044B000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1704-56-0x0000000000400000-0x000000000044B000-memory.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
gozi
Extracted
gozi
7711
checklist.skype.com
62.173.138.6
89.117.37.146
46.8.210.82
89.116.227.15
31.41.44.51
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Targets
-
-
Target
1704-56-0x0000000000400000-0x000000000044B000-memory.dmp
-
Size
300KB
-
MD5
a61baa82346e55a1b0f1fdd1bf47b75b
-
SHA1
58b41b569660a8b8d0d3ca87c8a1753740be3ff8
-
SHA256
d733caf5882c2f18058aa29703e42aa3bed6de60ad771536d77d8aabbf1d542e
-
SHA512
2fa14e9918d987c31aa1d62e86881628265b236d18b5ecb55764336a1a3ff024cccba83c6b1fabddacb8e1c14709bfa4d218875ed946815d3bcb3fced9f9bb3e
-
SSDEEP
3072:VfKprNoVUE3Hn5utOJy6xOAOwk+JpWV9I7C+vaWTqF:RKprOVUu3DOwk+JpWV9oCua3
Score3/10 -