General
-
Target
2560-138-0x0000000000400000-0x00000000004DB000-memory.dmp
-
Size
876KB
-
Sample
230322-ksbwyafh44
-
MD5
fad6addc1f6523fefb1fd743b5f011ae
-
SHA1
60921e887322151fdc1e5e9fa7383736adb42cef
-
SHA256
d80ff320e93e74fc2603dd5d310babd86112474c3e99935c5b299afd4ef5e03d
-
SHA512
d0ea88a68a1151fdce39517317e8324df03d9ce63bc322e9c57f7bfb5f086f7ae83a1ddc5d5455bf32ed35b949dd3221e774fcd66edca87f894cd4697e540ba5
-
SSDEEP
3072:VfKapVNoVUE3HnyZRhkNfAPILo04JyVnlT8M43xqwcnUi6JIUjixCTgwn0F:RKapVOVUuSD2+tQVlTa3xB0UB
Behavioral task
behavioral1
Sample
2560-138-0x0000000000400000-0x00000000004DB000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2560-138-0x0000000000400000-0x00000000004DB000-memory.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
gozi
Extracted
gozi
7715
checklist.skype.com
62.173.142.50
31.41.44.87
109.248.11.217
212.109.218.151
5.44.45.83
62.173.142.81
193.233.175.113
109.248.11.184
212.109.218.26
185.68.93.7
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Targets
-
-
Target
2560-138-0x0000000000400000-0x00000000004DB000-memory.dmp
-
Size
876KB
-
MD5
fad6addc1f6523fefb1fd743b5f011ae
-
SHA1
60921e887322151fdc1e5e9fa7383736adb42cef
-
SHA256
d80ff320e93e74fc2603dd5d310babd86112474c3e99935c5b299afd4ef5e03d
-
SHA512
d0ea88a68a1151fdce39517317e8324df03d9ce63bc322e9c57f7bfb5f086f7ae83a1ddc5d5455bf32ed35b949dd3221e774fcd66edca87f894cd4697e540ba5
-
SSDEEP
3072:VfKapVNoVUE3HnyZRhkNfAPILo04JyVnlT8M43xqwcnUi6JIUjixCTgwn0F:RKapVOVUuSD2+tQVlTa3xB0UB
Score3/10 -