Overview

overview

10

Static

static

10

1724-56-0x...ry.exe

windows7-x64

1

1724-56-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    1724-56-0x0000000000400000-0x0000000000458000-memory.dmp

  • Size

    352KB

  • MD5

    4923abded366e24c6f9337dea9c5c237

  • SHA1

    2da81c5705c09050e13bc9c9c4325e40c99af01d

  • SHA256

    aa3cae3f93941ffdae797a83b96227e2d899e627d56ac87218f2f090bc133ceb

  • SHA512

    db8a16f9a34c6c4c02e3b349214b73bec7fd961570595dd660981002d6e679ffec4e3a1acde270a3289f70023960e5aafeca3ff41145cd3c998f9674070ea1a6

  • SSDEEP

    6144:5ZdD4XY2m/1/uffekdheqlz407lw/h0isvzpQ6ijLxQFiaIN:TdDk2N/uffeH0exqzpQ6ijqF

Score
10/10
isfb7638gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7638

C2

185.31.160.147

31.41.44.63

31.41.46.120
Attributes
  • base_path

    /drew/

  • build

    250235

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1724-56-0x0000000000400000-0x0000000000458000-memory.dmp
    .exe windows x86


    Headers

    Sections