Overview

overview

10

Static

static

10

gozi.dll

windows7-x64

1

gozi.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    gozi.payload-disk

  • Size

    43KB

  • MD5

    fde4530b8ed09f2923da13c8ef15de28

  • SHA1

    628fa92c9bd6ebc83d098a577bd2807ea0bc3f5c

  • SHA256

    b994d6c78aab2c73c21bbebc4ae04a003d18d98da6a840e265f2f028110adb46

  • SHA512

    c153998a2ccd141c23c347ddf088c7243eda3d136ba9b31b176ef14d2aade6b737e0f78eff0edcd1dd8f3cc8a402cde3c0e30cc9d3cb4fa46a89518c6c9a3e29

  • SSDEEP

    768:L0gsqVXye2rS/Q4VYXQIVpCHlNBmQWGk2j+A6ewBvu7gpzhK3D1Gc:L9sq8S/QEYXQIVWlvmYp6ewNu7hD1Gc

Score
10/10
isfb7708gozi

Malware Config

Extracted

Family

gozi

Botnet

7708

C2

checklist.skype.com

185.31.160.197

31.41.44.76

194.116.163.130
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • gozi.payload-disk
    .dll windows x86

    ef075d26b728b78a932306e24062e80c


    Headers

    Imports

    Sections