Overview

overview

10

Static

static

10

2044-56-0x...ry.exe

windows7-x64

1

2044-56-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2044-56-0x0000000000400000-0x0000000000573000-memory.dmp

  • Size

    1.4MB

  • MD5

    f0c873681d6e927239b480d48efbecb9

  • SHA1

    180b1953b4acb839b4242d50ecd79f1370facff3

  • SHA256

    195d0643be769c2418df17f8b1c779825346538facdbd817ba85d0e6746fa0fa

  • SHA512

    574876426218bef4b5b1360064ae6a60895dbfdf552c342ee8b55e9d32e3974341f8b680da2a4e69c6f0d2e032b52e7c42c0f627292b238ef81bdffe7a45d4b7

  • SSDEEP

    3072:4fKWh5zT94QeZD5GmAlTt0tT3TC/VsvoYiR8YQmy9WeQjG+EB:WKWh5t2kPHYiRNQmreN+

Score
10/10
isfb7709gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7709

C2

checklist.skype.com

62.173.141.252

31.41.44.33

109.248.11.112
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 2044-56-0x0000000000400000-0x0000000000573000-memory.dmp
    .exe windows x86


    Headers

    Sections