Overview

overview

10

Static

static

10

748-135-0x...ry.exe

windows7-x64

748-135-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    748-135-0x0000000000400000-0x0000000000463000-memory.dmp

  • Size

    396KB

  • MD5

    ac7fa6b9cd35d5d01768697985c2a97d

  • SHA1

    0fa60b10f0c785dd9bddcb03a5321b778ed9ab29

  • SHA256

    e296f44b13b1e2ce79321e0c036ad4a7a1eb57ed178151935483a2aac2f4dff3

  • SHA512

    2d9a35a93904a9524de31d1807409931445920015167ae277146b66a0aa5777eabdcde7c68d2df7fbab73e39419db5d7a5f1e0dd2b53d477b68968993aae7236

  • SSDEEP

    6144:C1PYZnXb4Vyu+PR8PQ85IgNMW85cK4eRu4:C1PwrsDsBCdKl8

Score
10/10
isfb7639gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7639

C2

31.41.44.43

62.173.147.143

31.41.44.63

62.173.147.113
Attributes
  • base_path

    /drew/

  • build

    250249

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 748-135-0x0000000000400000-0x0000000000463000-memory.dmp
    .exe windows x86


    Headers

    Sections