Overview

overview

10

Static

static

10

3316-143-0...ry.exe

windows7-x64

1

3316-143-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    3316-143-0x00000000000C0000-0x00000000000CE000-memory.dmp

  • Size

    56KB

  • MD5

    216a45f8df8a4a2593e053abc1829692

  • SHA1

    4972c50016332950711dc43f91a83a2f67dad7e3

  • SHA256

    3abc3984a15a548212f30193095d9541fd74f4393bfa3298a9cf54c81bdebb5a

  • SHA512

    53c3948b269d8c784d464cf55fd82afe0f5d3e537578b2e499f07d277302ada90da3a7f2b013286f42048675b72fc4d54e8e06c9441fe4963c9ee0a78cd8f2fd

  • SSDEEP

    768:i7B/ofjY+BV9GFAjvZXQruFPu4akfiEmrNX11Uxfef+Sl:iVwLY+BaajvjJak6HUfI

Score
10/10
isfb1001gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1001

C2

https://checklist.skype.com

http://176.10.125.84

http://91.242.219.235

http://79.132.130.73

http://176.10.119.209

http://194.76.225.88

http://79.132.134.158
Attributes
  • base_path

    /microsoft/

  • build

    260255

  • exe_type

    loader

  • extension

    .acx

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 3316-143-0x00000000000C0000-0x00000000000CE000-memory.dmp
    .exe windows x86


    Headers

    Sections