Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    gozi_maintainabovl.exe.bin

  • Size

    52KB

  • MD5

    c69567a16e20342399da26924dd14bcc

  • SHA1

    40290270ecd352e304cada06672c71c8692f7d53

  • SHA256

    2ddb1756ee98a96818a9baa62496fc3a3099b7b8375ddbdc21b3e814ab623847

  • SHA512

    bb0918f09750328334d4310937e8af81c476eaf6088055e7f8c83a948906e9bb23bf80712d5b6bfdc13750f1e8a89c129c7ab8852a16dba440f95b26c5006f12

  • SSDEEP

    768:6KbMPvmKymyV34OB9bl5n+iRjn9P1avZa9Bmr1h097mI5ce:64MHhRyt5+0zavZangX097m1

Score
10/10
isfb7704gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7704

C2

checklist.skype.com

62.173.149.202

31.41.44.158

193.0.178.157
Attributes
  • base_path

    /drew/

  • build

    250249

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • gozi_maintainabovl.exe.bin
    .exe windows x86


    Headers

    Sections