Overview

overview

10

Static

static

10

1636-59-0x...ry.exe

windows7-x64

1

1636-59-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    1636-59-0x0000000000400000-0x000000000044C000-memory.dmp

  • Size

    304KB

  • MD5

    a5e18bce005154f940337efd32feabac

  • SHA1

    8ffb7fb3421d586b2998a9d00680e9a3a68a7466

  • SHA256

    834148478cb59e03a60109418315cc6b9d47984a068a918141b660c757bca442

  • SHA512

    60c24b49089c3d163450b079259b3c96f756d468a123df36be5d48d31b972ade23dc4c3e500b1d5fabe92d9985a3d1983e43c2b67009a74dcbf8b74f695742a4

  • SSDEEP

    3072:VfK9prNoVUE3Hn5PcN6ugTCIKmO8YUAWDE/Rp9oYFGH52c:RK9prOVUuGNYDlO8YI4Zp9oS

Score
10/10
isfb7711gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7711

C2

checklist.skype.com

62.173.138.6

89.117.37.146

46.8.210.82

89.116.227.15

31.41.44.51
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1636-59-0x0000000000400000-0x000000000044C000-memory.dmp
    .exe windows x86


    Headers

    Sections