Behavioral task
behavioral1
Sample
1108-56-0x0000000000400000-0x00000000004DA000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1108-56-0x0000000000400000-0x00000000004DA000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1108-56-0x0000000000400000-0x00000000004DA000-memory.dmp
-
Size
872KB
-
MD5
deaf09dbe2d77eeada6b6e9b02b38f90
-
SHA1
b4c44445a432a60ee3e34feda1a83cd9eeed438b
-
SHA256
05d7f983a059c2c7ceb47ae78591ac5f45e03e6560051b08270500fb9356f548
-
SHA512
8cace5cef8d172da71773a16c55981b5710cec14a4d94604d8e6aa275a0b25ec34531fbe5d388645bbf45026de01b1c0991b8f96d272decfb3434a0ca38a3bf0
-
SSDEEP
3072:VfKNVNoVUE3Hn1I/ttvi/xHPlWsGJmog5hmSzaNxAYCXjJJ:RKNVOVUuVI//qvlWso8kkaXAz
Malware Config
Extracted
gozi
Extracted
gozi
7715
checklist.skype.com
62.173.142.50
31.41.44.87
109.248.11.217
212.109.218.151
5.44.45.83
62.173.142.81
193.233.175.113
109.248.11.184
212.109.218.26
185.68.93.7
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Signatures
-
Gozi family
Files
-
1108-56-0x0000000000400000-0x00000000004DA000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 1024B - Virtual size: 735B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ