General
-
Target
contratto.zip
-
Size
478B
-
Sample
230309-j5anzabc93
-
MD5
ebbe6434b8d6ab9439c69218f6513fbb
-
SHA1
4abb5e3486546ac452b99d3b04079b810f151ee0
-
SHA256
120b092e8d8212a7c0e796ac320dd10c56c8b801aa8fb234cb577d5f0dabc05c
-
SHA512
d5a7fbae35071dcc4826a87e26bb8dc4fe21816b0c2f905f219ce820f3972c7cf83c4ff3a65567eda5aaec87e4f2816306c1b4fe7ff2699c88fcca7be077fa02
Static task
static1
Behavioral task
behavioral1
Sample
contratto/contratto.url
Resource
win7-20230220-en
Malware Config
Extracted
gozi
Extracted
gozi
7712
checklist.skype.com
62.173.141.36
31.41.44.85
193.233.175.98
46.8.210.110
89.116.227.49
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Targets
-
-
Target
contratto/contratto.url
-
Size
191B
-
MD5
c57ce09111a84d1110b24a8505ff5804
-
SHA1
9fd1e2577f10a24c2678803e073d35e41b551eb2
-
SHA256
257413c17f63500a76f9d0216a8dee283021299a61dc0539e6e870fd5d78177b
-
SHA512
71cf1e5d069a75be84cfcaf82479fb037e75055c05e94ad212453769288b1e3b194156fad802619b0850c9e9abb3c045600779de234b8b51505b1a54f46b7c84
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-