Overview

overview

10

Static

static

10

2584-138-0...ry.exe

windows7-x64

1

2584-138-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2584-138-0x0000000000400000-0x0000000002BB3000-memory.dmp

  • Size

    39.7MB

  • MD5

    3e6b7b796f55383d5d496a4db7556b9f

  • SHA1

    e83cea603213243b2a946c9b9eedc0ccfcbe763b

  • SHA256

    d6ee15ee7229f29d2a96165005e87419a82df1354a13fdc9df18d4c310de4f87

  • SHA512

    869cf11264f4f9d476f7249e28ee89a9871b8e72cc69863df598a722d10a4ac10ab58483091c9f7fd06cc37f9e1b0aaac4ed23c3722a869e06c31c0d5791217e

  • SSDEEP

    3072:4fKWEh5zT94QeZDMp9esiOhXdkH7GTkwbpSGrKRW5NVdXesRInB9azOPR:WKWEh5t2OeO9dTkSRKMR401zOP

Score
10/10
isfb7709gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7709

C2

checklist.skype.com

62.173.141.252

31.41.44.33

109.248.11.112
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 2584-138-0x0000000000400000-0x0000000002BB3000-memory.dmp
    .exe windows x86


    Headers

    Sections