Behavioral task
behavioral1
Sample
2464-1-0x0000000000130000-0x000000000013E000-memory.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2464-1-0x0000000000130000-0x000000000013E000-memory.dll
Resource
win10v2004-20230915-en
General
-
Target
2464-1-0x0000000000130000-0x000000000013E000-memory.dmp
-
Size
56KB
-
MD5
0caf18e517a887f0879f4c4ddcc92d46
-
SHA1
230aa937ce3246d359ee43c3576a61dfb4698867
-
SHA256
9291f80e0b06a2c7be36aa22390918aec7798604a91b385c48a4623c86b4f83a
-
SHA512
9edb6a0deeeed3cf12dcf0c19d5acae2aff2610da743d1e0ef812ad9507fb55fec5086880098aa3f0f13c4d54b196590bb69977e85750de1c73a68d1e2c5a8ea
-
SSDEEP
768:A2kfIL3q8aQ+73Mncvo0ya8Kl7aQixYgxYJmv0NHY7lbjNltdX20JJ:OQO8aQ+73MnQBVJaf3C7YJj3HG0JJ
Malware Config
Extracted
gozi
Extracted
gozi
5050
fotexion.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2464-1-0x0000000000130000-0x000000000013E000-memory.dmp
Files
-
2464-1-0x0000000000130000-0x000000000013E000-memory.dmp.dll windows:5 windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 604B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 1024B - Virtual size: 735B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ