General
-
Target
344-138-0x0000000000400000-0x0000000002B0F000-memory.dmp
-
Size
39.1MB
-
Sample
230315-tcc9haeb34
-
MD5
1f0a8b8548ce55bad071420d0eb0b404
-
SHA1
146b319c4634f0c9f8b2674a1bcdf2337d655be9
-
SHA256
f5625b876e945e9ae8579633c294a24f1ba9e7215dc6376be203ab302f0468dc
-
SHA512
96a3c672e6b3d4590c82f533028a58abbf7d445a140d5b0666868fdb6a052bef32681ee7a9522dea53816280a66e97e4e1c2ddba221da6f94413832c4ade902a
-
SSDEEP
3072:KfKlGDN0K3vMUZr2UDhW8c/S9OC1hE/uJuP8QrW7xNlfo:0KlGDB3vCmR9p02p9be
Behavioral task
behavioral1
Sample
344-138-0x0000000000400000-0x0000000002B0F000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
344-138-0x0000000000400000-0x0000000002B0F000-memory.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
gozi
Extracted
gozi
7714
checklist.skype.com
5.44.43.17
31.41.44.108
62.173.138.213
109.248.11.174
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Targets
-
-
Target
344-138-0x0000000000400000-0x0000000002B0F000-memory.dmp
-
Size
39.1MB
-
MD5
1f0a8b8548ce55bad071420d0eb0b404
-
SHA1
146b319c4634f0c9f8b2674a1bcdf2337d655be9
-
SHA256
f5625b876e945e9ae8579633c294a24f1ba9e7215dc6376be203ab302f0468dc
-
SHA512
96a3c672e6b3d4590c82f533028a58abbf7d445a140d5b0666868fdb6a052bef32681ee7a9522dea53816280a66e97e4e1c2ddba221da6f94413832c4ade902a
-
SSDEEP
3072:KfKlGDN0K3vMUZr2UDhW8c/S9OC1hE/uJuP8QrW7xNlfo:0KlGDB3vCmR9p02p9be
Score3/10 -