00000000.00000003.437821342.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | |
00000000.00000003.437821342.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_fd494041 | unknown | unknown | - 0x1228:$a1: /C ping localhost -n %u && del "%s"
- 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
- 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
- 0xa9c:$a5: filename="%.4u.%lu"
- 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xe6d:$a9: &whoami=%s
- 0xe56:$a10: %u.%u_%u_%u_x%u
- 0xd63:$a11: size=%u&hash=0x%08x
- 0xb1d:$a12: &uptime=%u
- 0x6fb:$a13: %systemroot%\system32\c_1252.nls
- 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
|
00000000.00000003.437821342.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_261f5ac5 | unknown | unknown | - 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
- 0x1ca0:$a9: Software\AppDataLow\Software\Microsoft\
|
00000000.00000003.437852108.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | |
00000000.00000003.437852108.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_fd494041 | unknown | unknown | - 0x1228:$a1: /C ping localhost -n %u && del "%s"
- 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
- 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
- 0xa9c:$a5: filename="%.4u.%lu"
- 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xe6d:$a9: &whoami=%s
- 0xe56:$a10: %u.%u_%u_%u_x%u
- 0xd63:$a11: size=%u&hash=0x%08x
- 0xb1d:$a12: &uptime=%u
- 0x6fb:$a13: %systemroot%\system32\c_1252.nls
- 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
|
00000000.00000003.437852108.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_261f5ac5 | unknown | unknown | - 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
- 0x1ca0:$a9: Software\AppDataLow\Software\Microsoft\
|
00000000.00000003.437607337.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | |
00000000.00000003.437607337.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_fd494041 | unknown | unknown | - 0x1228:$a1: /C ping localhost -n %u && del "%s"
- 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
- 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
- 0xa9c:$a5: filename="%.4u.%lu"
- 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xe6d:$a9: &whoami=%s
- 0xe56:$a10: %u.%u_%u_%u_x%u
- 0xd63:$a11: size=%u&hash=0x%08x
- 0xb1d:$a12: &uptime=%u
- 0x6fb:$a13: %systemroot%\system32\c_1252.nls
- 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
|
00000000.00000003.437607337.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_261f5ac5 | unknown | unknown | - 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
- 0x1ca0:$a9: Software\AppDataLow\Software\Microsoft\
|
00000000.00000003.437902952.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | |
00000000.00000003.437902952.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_fd494041 | unknown | unknown | - 0x1228:$a1: /C ping localhost -n %u && del "%s"
- 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
- 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
- 0xa9c:$a5: filename="%.4u.%lu"
- 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xe6d:$a9: &whoami=%s
- 0xe56:$a10: %u.%u_%u_%u_x%u
- 0xd63:$a11: size=%u&hash=0x%08x
- 0xb1d:$a12: &uptime=%u
- 0x6fb:$a13: %systemroot%\system32\c_1252.nls
- 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
|
00000000.00000003.437902952.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_261f5ac5 | unknown | unknown | - 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
- 0x1ca0:$a9: Software\AppDataLow\Software\Microsoft\
|
00000000.00000003.437680280.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | |
00000000.00000003.437680280.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_fd494041 | unknown | unknown | - 0x1228:$a1: /C ping localhost -n %u && del "%s"
- 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
- 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
- 0xa9c:$a5: filename="%.4u.%lu"
- 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xe6d:$a9: &whoami=%s
- 0xe56:$a10: %u.%u_%u_%u_x%u
- 0xd63:$a11: size=%u&hash=0x%08x
- 0xb1d:$a12: &uptime=%u
- 0x6fb:$a13: %systemroot%\system32\c_1252.nls
- 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
|
00000000.00000003.437680280.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_261f5ac5 | unknown | unknown | - 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
- 0x1ca0:$a9: Software\AppDataLow\Software\Microsoft\
|
00000000.00000003.437880464.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | |
00000000.00000003.437880464.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_fd494041 | unknown | unknown | - 0x1228:$a1: /C ping localhost -n %u && del "%s"
- 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
- 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
- 0xa9c:$a5: filename="%.4u.%lu"
- 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xe6d:$a9: &whoami=%s
- 0xe56:$a10: %u.%u_%u_%u_x%u
- 0xd63:$a11: size=%u&hash=0x%08x
- 0xb1d:$a12: &uptime=%u
- 0x6fb:$a13: %systemroot%\system32\c_1252.nls
- 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
|
00000000.00000003.437880464.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_261f5ac5 | unknown | unknown | - 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
- 0x1ca0:$a9: Software\AppDataLow\Software\Microsoft\
|
00000000.00000003.436425972.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | |
00000000.00000003.436425972.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_fd494041 | unknown | unknown | - 0x1228:$a1: /C ping localhost -n %u && del "%s"
- 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
- 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
- 0xa9c:$a5: filename="%.4u.%lu"
- 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xe6d:$a9: &whoami=%s
- 0xe56:$a10: %u.%u_%u_%u_x%u
- 0xd63:$a11: size=%u&hash=0x%08x
- 0xb1d:$a12: &uptime=%u
- 0x6fb:$a13: %systemroot%\system32\c_1252.nls
- 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
|
00000000.00000003.436425972.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_261f5ac5 | unknown | unknown | - 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
- 0x1ca0:$a9: Software\AppDataLow\Software\Microsoft\
|
00000000.00000002.561151548.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | |
00000000.00000002.561151548.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_fd494041 | unknown | unknown | - 0x1228:$a1: /C ping localhost -n %u && del "%s"
- 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
- 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
- 0xa9c:$a5: filename="%.4u.%lu"
- 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xe6d:$a9: &whoami=%s
- 0xe56:$a10: %u.%u_%u_%u_x%u
- 0xd63:$a11: size=%u&hash=0x%08x
- 0xb1d:$a12: &uptime=%u
- 0x6fb:$a13: %systemroot%\system32\c_1252.nls
- 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
|
00000000.00000002.561151548.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_261f5ac5 | unknown | unknown | - 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
- 0x1ca0:$a9: Software\AppDataLow\Software\Microsoft\
|
00000000.00000002.560851312.0000000002D56000.00000040.00000020.00020000.00000000.sdmp | Windows_Trojan_RedLineStealer_ed346e4c | unknown | unknown | - 0x69c9:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
|
00000000.00000002.560764513.0000000002B60000.00000040.00001000.00020000.00000000.sdmp | Windows_Trojan_Smokeloader_3687686f | unknown | unknown | - 0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
|
00000000.00000003.437645117.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | |
00000000.00000003.437645117.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_fd494041 | unknown | unknown | - 0x1228:$a1: /C ping localhost -n %u && del "%s"
- 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
- 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
- 0xa9c:$a5: filename="%.4u.%lu"
- 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xe6d:$a9: &whoami=%s
- 0xe56:$a10: %u.%u_%u_%u_x%u
- 0xd63:$a11: size=%u&hash=0x%08x
- 0xb1d:$a12: &uptime=%u
- 0x6fb:$a13: %systemroot%\system32\c_1252.nls
- 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
|
00000000.00000003.437645117.00000000054A8000.00000004.00000020.00020000.00000000.sdmp | Windows_Trojan_Gozi_261f5ac5 | unknown | unknown | - 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
- 0x1ca0:$a9: Software\AppDataLow\Software\Microsoft\
|
Process Memory Space: server.exe PID: 5084 | JoeSecurity_Ursnif | Yara detected Ursnif | Joe Security | |
Process Memory Space: server.exe PID: 5084 | Windows_Trojan_Gozi_fd494041 | unknown | unknown | - 0x13f5:$a5: filename="%.4u.%lu"
- 0x15ab:$a5: filename="%.4u.%lu"
- 0x139e5:$a5: filename="%.4u.%lu"
- 0x13b9b:$a5: filename="%.4u.%lu"
- 0xfa8:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x13598:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x111c:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0x14f5:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0x16ad:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0x6169:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0x624a:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0x64ae:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xebf9:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xecda:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0xee82:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0x1370c:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0x13ae5:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0x13c9d:$a8: %08X-%04X-%04X-%04X-%08X%04X
- 0x190d:$a9: &whoami=%s
- 0x13efd:$a9: &whoami=%s
- 0x18f6:$a10: %u.%u_%u_%u_x%u
|
Process Memory Space: server.exe PID: 5084 | Windows_Trojan_Gozi_261f5ac5 | unknown | unknown | - 0x149c:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x1654:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x13a8c:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0x13c44:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
- 0xfa8:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x1005:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x13598:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x135f5:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
- 0x13c1:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0x1577:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0x139b1:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0x13b67:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
- 0x17a7:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0x1a80:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0x13d97:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0x14070:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
- 0x1849:$a9: Software\AppDataLow\Software\Microsoft\
- 0x1b1d:$a9: Software\AppDataLow\Software\Microsoft\
- 0x265a:$a9: Software\AppDataLow\Software\Microsoft\
- 0x26a7:$a9: Software\AppDataLow\Software\Microsoft\
- 0x13e39:$a9: Software\AppDataLow\Software\Microsoft\
|
Click to see the 27 entries |