Overview

overview

10

Static

static

10

2000-56-0x...ry.exe

windows7-x64

1

2000-56-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2000-56-0x0000000000400000-0x00000000004B2000-memory.dmp

  • Size

    712KB

  • MD5

    01951450888078d7ec95a405670f241f

  • SHA1

    d97241f96cb08cf0d1cf704c188575b6e3b7f42d

  • SHA256

    1e161b2321e7449e38c8a5873ce6c2b1ccf9cb85bf2ec04a416054635872be03

  • SHA512

    4a9f52fcf1948d52084196b224371a95c82badb79a410cf88386eabe04fc10c19fde06e8118188405b0424d225c6b3e10b7c52f384b3ad747de5bde5a024413c

  • SSDEEP

    3072:JfK65zBGU8UDeCyjHp3JXurB/PCwFGCsvndmQOmcgliKC:VK63GU965er5PCwYCsvnJ5zi

Score
10/10
isfb7712gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7712

C2

checklist.skype.com

62.173.140.236

31.41.44.92

46.8.210.143

45.128.185.33
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 2000-56-0x0000000000400000-0x00000000004B2000-memory.dmp
    .exe windows x86


    Headers

    Sections