Overview

overview

10

Static

static

10

1288-138-0...ry.exe

windows7-x64

1

1288-138-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    1288-138-0x0000000000400000-0x00000000004B2000-memory.dmp

  • Size

    712KB

  • MD5

    2aa5d3cede0aca2995349a66da7b61a1

  • SHA1

    14465c90247db6a6302fd3af66b4b11159348e67

  • SHA256

    4c7779b1bb5a75504ab0cabc5425ce0bc9938c5410d2e2c4279ddcfd4f893063

  • SHA512

    bac3bfe36c3c839d041b2d5cb97f4b4218bd2cb87deda98932179b975dde9e6278eac56e6398cac1b2b730f91c23e177b5cd6c135b23a4a51bb1009f900083b0

  • SSDEEP

    3072:JfKHw5zBGU8UDeCyjq2q7vakhWip4RwGkOHJb9U9X+8eFPOmcgl72C:VKHw3GU9ssWip4tkaUdeFP5z7

Score
10/10
isfb7712gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7712

C2

checklist.skype.com

62.173.140.236

31.41.44.92

46.8.210.143

45.128.185.33
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1288-138-0x0000000000400000-0x00000000004B2000-memory.dmp
    .exe windows x86


    Headers

    Sections