Overview

overview

10

Static

static

10

1680-56-0x...ry.exe

windows7-x64

1

1680-56-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    1680-56-0x0000000000400000-0x00000000004C6000-memory.dmp

  • Size

    792KB

  • MD5

    ab704f7bbd7de527c69214b957238102

  • SHA1

    5be0708dbc109799190ffa3217c95c1d10dae12f

  • SHA256

    f19bc070421ddec1a82ca3137a694d8c27ca8400484b1f63f74a075610af49e7

  • SHA512

    ffdafc884785665fab0a9d022ae3a9e10fc943bc8303ef580202393a4768457ef54d434b46730bdaf2dc8c49fe67fb11853db1708ce7ab09f9d81ad6b16ff5fb

  • SSDEEP

    3072:nfKinKUZekHml9jSCwEFG3mM77HkSyNjiGv7R6Xtny+2P758Jr9EoDNb:fKiKH7l9MEaz2Njiu7RMyLqEMNb

Score
10/10
isfb7710gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7710

C2

checklist.skype.com

62.173.140.103

31.41.44.63

46.8.19.239

185.77.96.40

46.8.19.116

31.41.44.48

62.173.139.11

62.173.138.251
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1680-56-0x0000000000400000-0x00000000004C6000-memory.dmp
    .exe windows x86


    Headers

    Sections