Overview

overview

10

Static

static

10

5028-135-0...ry.exe

windows7-x64

1

5028-135-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    5028-135-0x0000000000400000-0x000000000055E000-memory.dmp

  • Size

    1.4MB

  • MD5

    774d954a04fe654feb8e64f71ef3c9a0

  • SHA1

    aa639129491154246449666ebd447c65629523d4

  • SHA256

    20d3df311b2ae9711b0849aa12527419e308e3fa3cbfcec06d201cf3d0e60f1f

  • SHA512

    d4ce9e364e4d3a8c7a3ce7faa0afcb73e01cccf39235e6c1f66299ff4f27890001853319486988a011d6e45fce1aa659157891c361471b2189c02064bac56932

  • SSDEEP

    3072:gfKF25zT94QeZDLzA+iQC7AUgA0f6PZO/nFedrsliSKAyo:OKF25t2fzK7AmJO/nFe9SKD

Score
10/10
isfb7708gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7708

C2

checklist.skype.com

62.173.147.156

31.41.44.3

46.8.19.140

45.151.232.3

62.173.139.21

185.142.99.47

31.41.44.121
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 5028-135-0x0000000000400000-0x000000000055E000-memory.dmp
    .exe windows x86


    Headers

    Sections