Overview

overview

10

Static

static

10

1124-56-0x...ry.exe

windows7-x64

1124-56-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1124-56-0x0000000000400000-0x0000000002C4E000-memory.dmp

  • Size

    40.3MB

  • MD5

    ac1b3336e0a439745bb46c6ece90fbba

  • SHA1

    924598596031e93cd509299b2c96e00c8507ad7b

  • SHA256

    152b636186d14cd4834df774d0d3195453630682d010092ee2f05c62492181ef

  • SHA512

    86218f6e32de08a76b6b4fbf4d514dd8515d8b8769d13b7757057f96a4bd1bcf67c94ef8704b8aa68f5d09fd5c7919ff0a865557317728a029312ad983e07d7f

  • SSDEEP

    6144:6eWr+fBar8L80cRNzdND/XQQbpajooxupmLUsjT:6eWr+Y4LNcR1dND/5bpajooxupmL

Score
10/10
isfb7701gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7701

C2

checklist.skype.com

62.173.145.223

31.41.44.105

45.89.66.58
Attributes
  • base_path

    /drew/

  • build

    250249

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1124-56-0x0000000000400000-0x0000000002C4E000-memory.dmp
    .exe windows x86


    Headers

    Sections