Overview

overview

10

Static

static

10

2912-138-0...ry.exe

windows7-x64

1

2912-138-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2912-138-0x0000000000400000-0x0000000002B0F000-memory.dmp

  • Size

    39.1MB

  • MD5

    b14088ca47bd383eab4f9bc9ca7a578c

  • SHA1

    2416066e5fbf2ff03c3bbba8d54ffe89f5661e0e

  • SHA256

    d100564ce69636746998f1e551d1de5aa19473571f1f3db27b3670068df4a879

  • SHA512

    e9ece129dd80f1726cba7b2d779edc44ea2b78402fad79da27a009f6159747ed378e284d5ac2644cb5823941e2822dd6013271f8d8027254b51ead66554fbe09

  • SSDEEP

    3072:KfKZGDN0K3vMUZr2oDhW8c/S9OC1hE/uJuP8QrW7VNlfo:0KZGDB3vCSR9p02p9Xe

Score
10/10
isfb7714gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7714

C2

checklist.skype.com

5.44.43.17

31.41.44.108

62.173.138.213

109.248.11.174
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 2912-138-0x0000000000400000-0x0000000002B0F000-memory.dmp
    .exe windows x86


    Headers

    Sections