Overview

overview

10

Static

static

10

1704-56-0x...ry.exe

windows7-x64

1

1704-56-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    1704-56-0x0000000000400000-0x0000000000573000-memory.dmp

  • Size

    1.4MB

  • MD5

    ae4eecec455077627d519914b0a616ec

  • SHA1

    c08278597dfdbe2f6f94358405f06b18b74b0f3e

  • SHA256

    dc94d72b3c505d1a6f191e7110a0f2018ef035eb45b1759992c97dc0a55f993a

  • SHA512

    1b381c607f389bf9d7e46085a67f8c2e034025414aab2949836dff321a4b895e1213ddbec575b0c89d0a259b06f36ad2efff41506db8be87e578cf9fd9150262

  • SSDEEP

    3072:4fKHh5zT94QeZD5GmAlTt0tT3TC/VsvoYiR8YQmy9WehG+EB:WKHh5t2kPHYiRNQmrew+

Score
10/10
isfb7709gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7709

C2

checklist.skype.com

62.173.141.252

31.41.44.33

109.248.11.112
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1704-56-0x0000000000400000-0x0000000000573000-memory.dmp
    .exe windows x86


    Headers

    Sections