General
-
Target
1204-56-0x0000000000400000-0x00000000004AD000-memory.dmp
-
Size
692KB
-
Sample
230320-n3cg1afd4z
-
MD5
c92bce5617c9ef30d6b97755dc62ae4d
-
SHA1
4e8b612320329921447d3bbf8a5179ef3f0a4e17
-
SHA256
d39c873bc2a8511abc4f7d646bf0c92d698d9e432f8ba4ee6092ac710e485280
-
SHA512
4b0f198d29823bc630ba344c4c70adcc5d012ed681882db5d934701abfab188b9324a811af16807bb3ca2962e0aa70769c81fda7032d577904d1f1e59505f356
-
SSDEEP
3072:wfKfoyNoVUE3HnrnC+hMIPZSyqGr7tA0jtejRXwtiget:+KfbOVUujnhMIhSyzrh7jte9Oig
Behavioral task
behavioral1
Sample
1204-56-0x0000000000400000-0x00000000004AD000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1204-56-0x0000000000400000-0x00000000004AD000-memory.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
gozi
Extracted
gozi
7715
checklist.skype.com
62.173.142.81
193.233.175.113
109.248.11.184
212.109.218.26
185.68.93.7
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Targets
-
-
Target
1204-56-0x0000000000400000-0x00000000004AD000-memory.dmp
-
Size
692KB
-
MD5
c92bce5617c9ef30d6b97755dc62ae4d
-
SHA1
4e8b612320329921447d3bbf8a5179ef3f0a4e17
-
SHA256
d39c873bc2a8511abc4f7d646bf0c92d698d9e432f8ba4ee6092ac710e485280
-
SHA512
4b0f198d29823bc630ba344c4c70adcc5d012ed681882db5d934701abfab188b9324a811af16807bb3ca2962e0aa70769c81fda7032d577904d1f1e59505f356
-
SSDEEP
3072:wfKfoyNoVUE3HnrnC+hMIPZSyqGr7tA0jtejRXwtiget:+KfbOVUujnhMIhSyzrh7jte9Oig
Score3/10 -