Overview

overview

10

Static

static

10

2036-56-0x...ry.exe

windows7-x64

2036-56-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    2036-56-0x0000000000400000-0x0000000000452000-memory.dmp

  • Size

    328KB

  • MD5

    b265b5ae514249ab017f2f37a8985a54

  • SHA1

    e80560772dede7d81013cb949f06af1f9a0db684

  • SHA256

    7ca9ab266711ebd8f3b77f12adaac40e6006c3437222bd56fccd94c44c62e303

  • SHA512

    080e4c5c9c6fbbcbb7930efe4cdbffd91669788bbf135b5c638333912beccdb5d12ded909a68163edace47a59a4becbe09b818a7e3dbd27e143264230ceb84ef

  • SSDEEP

    3072:SH5he0Pu/6gLT5LczfV5lA53PcPSkgGl8foBwZ3tWF7jmcTSmcTdLXGpl:Sbe0PYZn9AV5l2PE3GZ9WFucC5

Score
10/10
isfb7702gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7702

C2

checklist.skype.com

62.173.138.160

31.41.44.122

193.0.178.141
Attributes
  • base_path

    /drew/

  • build

    250249

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 2036-56-0x0000000000400000-0x0000000000452000-memory.dmp
    .exe windows x86


    Headers

    Sections