Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Gozi_sampleFixed.exe

  • Size

    52KB

  • MD5

    1ba64eb5d0575578077bad8b723bee73

  • SHA1

    5b38d7825cc815695baa6524299b329233f41f09

  • SHA256

    bfdcf036ab0c6817bce316404af5844cac6f6629f058f899695b1b692c6afe5c

  • SHA512

    1c3f95ba3d1eac6167d5957f997943f474f32e2bd7d8fcb4005660b7254895a384e816aebfe704bc47b9cd411d6beb8bff126ad3763bceb7b2133d16066abdf6

  • SSDEEP

    768:xKbMPvusy2yV34OB9bl5n+iRjn9P1avZa9Bmr1h097mI5:x4MHbNyt5+0zavZangX097m

Score
10/10
isfb7703gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7703

C2

checklist.skype.com

62.173.138.234

31.41.44.112

91.107.119.114
Attributes
  • base_path

    /drew/

  • build

    250249

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • Gozi_sampleFixed.exe
    .exe windows x86

    1640d668d1471f340cbe565fe63522f6


    Headers

    Imports

    Sections