Overview

overview

10

Static

static

10

4524-138-0...ry.exe

windows7-x64

1

4524-138-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4524-138-0x0000000000400000-0x0000000002BB3000-memory.dmp

  • Size

    39.7MB

  • MD5

    dc32eb51c5ecb0e7a7d1189f5689bc1c

  • SHA1

    a2066ddd6d4bbf05f9c1b228fcc1239efd13d3bb

  • SHA256

    9d4b6233860a4777d14b7749c241ea4b23bd84e2245fce5c1c6ffadc7d6fb8a0

  • SHA512

    e7a999bea1f7735b6949b78dfe21d77a2c4028f6c1085f4a3ba314724a5c161cf57422d9e7371bc707514f264c0ceb07ab4d4b1d0cda8205a8389a2f6b8bafb9

  • SSDEEP

    3072:4fKREh5zT94QeZDMp9es8OhXdkH7GTkwbpSGrKRW5NVdXesR2nB9azOPR:WKREh5t2O4O9dTkSRKMR40DzOP

Score
10/10
isfb7709gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7709

C2

checklist.skype.com

62.173.141.252

31.41.44.33

109.248.11.112
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 4524-138-0x0000000000400000-0x0000000002BB3000-memory.dmp
    .exe windows x86


    Headers

    Sections