General
-
Target
2044-56-0x0000000000400000-0x00000000004AD000-memory.dmp
-
Size
692KB
-
Sample
230320-mqs4jsfa4v
-
MD5
ccce0bcaf2f7d5695cf98525349d5374
-
SHA1
38bf17c6165415310c6eccb11074320791cb602e
-
SHA256
5e0c10963437283381e37a4353afe039b22550fc294b7d7d0fde130d498d6c3b
-
SHA512
39ed1bfb4e8a2fbcda78fc8bf2ba2eeee4abf21aa45c01854a8de3f2f26149ac0635c6b61baf5875877f0bf1f8e5a244c800994dc7d33be23631d6534ae78b8f
-
SSDEEP
3072:wfKVoyNoVUE3HnrnBxHun7YB5ahAWlS5UQj96:+KVbOVUujBxAkBSAP5
Behavioral task
behavioral1
Sample
2044-56-0x0000000000400000-0x00000000004AD000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2044-56-0x0000000000400000-0x00000000004AD000-memory.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
gozi
Extracted
gozi
7715
checklist.skype.com
62.173.142.81
193.233.175.113
109.248.11.184
212.109.218.26
185.68.93.7
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Targets
-
-
Target
2044-56-0x0000000000400000-0x00000000004AD000-memory.dmp
-
Size
692KB
-
MD5
ccce0bcaf2f7d5695cf98525349d5374
-
SHA1
38bf17c6165415310c6eccb11074320791cb602e
-
SHA256
5e0c10963437283381e37a4353afe039b22550fc294b7d7d0fde130d498d6c3b
-
SHA512
39ed1bfb4e8a2fbcda78fc8bf2ba2eeee4abf21aa45c01854a8de3f2f26149ac0635c6b61baf5875877f0bf1f8e5a244c800994dc7d33be23631d6534ae78b8f
-
SSDEEP
3072:wfKVoyNoVUE3HnrnBxHun7YB5ahAWlS5UQj96:+KVbOVUujBxAkBSAP5
Score3/10 -