Overview

overview

10

Static

static

10

1876-138-0...ry.exe

windows7-x64

1

1876-138-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    1876-138-0x0000000000400000-0x0000000002BB4000-memory.dmp

  • Size

    39.7MB

  • MD5

    7d63a804873fe427c72ba50ad573a101

  • SHA1

    8502abdab58dd6f3a09795d2497e9e836012fc46

  • SHA256

    2ebe93f86e55e92be5cdca2cb3d1e6fc75ada4fea8bcd8995934481f283ea2af

  • SHA512

    faa4646cff1de81d21f19841d4e9e19fc7e4fb1cd9405be261343a70d969a707f5fb1dd211ceb8c7661d7a69d976bb070db5db4bd54cd5ad778e1347e1e80cc5

  • SSDEEP

    6144:WK3Eh5t2KiTrp7+cirTLw/UAzwN+NzOn:WiEh32KctaDAz

Score
10/10
isfb7709gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7709

C2

checklist.skype.com

62.173.141.252

31.41.44.33

109.248.11.112
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1876-138-0x0000000000400000-0x0000000002BB4000-memory.dmp
    .exe windows x86


    Headers

    Sections