Overview

overview

10

Static

static

10

1364-56-0x...ry.exe

windows7-x64

1

1364-56-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    1364-56-0x0000000000400000-0x0000000000597000-memory.dmp

  • Size

    1.6MB

  • MD5

    a7972e4a01f6ac8c3e4d498997b3b030

  • SHA1

    0f76f4ab528d70cc97a5e1c29b6ea9a3f78acf14

  • SHA256

    1656b3f713626f81d6795795b03e9ee6e1d03f1c7d111a87b692cbbef233dda3

  • SHA512

    cce5fa8587f9354b2d7e09916d6685917c9579ec64ac75e1a01f76892c7012b1e648a5b9643e6eaa926fe6d15b4df77f400895d4100184ab649f48629854cd35

  • SSDEEP

    6144:OKY25t29W2i8Gd+jVMRDgXWbQQkeeGSzk:O/2329W7HdWydbQQkeM

Score
10/10
isfb7708gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7708

C2

checklist.skype.com

62.173.147.156

31.41.44.3

46.8.19.140

45.151.232.3

62.173.139.21

185.142.99.47

31.41.44.121
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1364-56-0x0000000000400000-0x0000000000597000-memory.dmp
    .exe windows x86


    Headers

    Sections