Overview

overview

10

Static

static

10

1356-135-0...ry.exe

windows7-x64

1356-135-0...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1356-135-0x0000000000400000-0x0000000000452000-memory.dmp

  • Size

    328KB

  • MD5

    29a3a8abdc53209a7f810512c99ee4c1

  • SHA1

    b92bc8be7f85e15017e1495370748f1cb4457d7d

  • SHA256

    399a108861ed82da2a8ca544f03abb17f277dcb1a65978f06255330c5ff05c4e

  • SHA512

    b2c6b4fcbe4f5b1432fcc8c08d2c4d5312ed9b8a096298efeb9b59f51915633345e879a770e5b26be7667ac8ce19ce05885f5097259b2f11e3ea2fc4f2630d39

  • SSDEEP

    3072:SHbe0Pu/6gLT5LczfV5lA53PcPSkgGl8foBwZ3tWF7jmc6vmcTdLXGpl:S7e0PYZn9AV5l2PE3GZ9WFuc+5

Score
10/10
isfb7702gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7702

C2

checklist.skype.com

62.173.138.160

31.41.44.122

193.0.178.141
Attributes
  • base_path

    /drew/

  • build

    250249

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1356-135-0x0000000000400000-0x0000000000452000-memory.dmp
    .exe windows x86


    Headers

    Sections