General
-
Target
cdfcfae61a588ac434b33e8836f7796c1512c2926a7439e6a92c32c4ff4fa4ad_JC.url
-
Size
193B
-
Sample
231004-w5k6xsfh54
-
MD5
b5553dcc74a1f928f6619cff575c0568
-
SHA1
74d15b6d882d64fc3d21bcc47f9a99685a6705c2
-
SHA256
cdfcfae61a588ac434b33e8836f7796c1512c2926a7439e6a92c32c4ff4fa4ad
-
SHA512
439ffa6b0612ba0753a94de5a82d04e7c9fdade17c18a7d204c34260566af162555800260971470af5c79de5b4a15c18609b08da609cff0a4608aff143f5a9d2
Static task
static1
Behavioral task
behavioral1
Sample
cdfcfae61a588ac434b33e8836f7796c1512c2926a7439e6a92c32c4ff4fa4ad_JC.url
Resource
win7-20230831-en
Malware Config
Extracted
gozi
Extracted
gozi
5050
185.247.184.139
62.72.33.155
incontroler.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
mifrutty.com
systemcheck.top
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Targets
-
-
Target
cdfcfae61a588ac434b33e8836f7796c1512c2926a7439e6a92c32c4ff4fa4ad_JC.url
-
Size
193B
-
MD5
b5553dcc74a1f928f6619cff575c0568
-
SHA1
74d15b6d882d64fc3d21bcc47f9a99685a6705c2
-
SHA256
cdfcfae61a588ac434b33e8836f7796c1512c2926a7439e6a92c32c4ff4fa4ad
-
SHA512
439ffa6b0612ba0753a94de5a82d04e7c9fdade17c18a7d204c34260566af162555800260971470af5c79de5b4a15c18609b08da609cff0a4608aff143f5a9d2
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-