Overview

overview

10

Static

static

10

2872-138-0...ry.exe

windows7-x64

1

2872-138-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2872-138-0x0000000000400000-0x0000000002B0F000-memory.dmp

  • Size

    39.1MB

  • MD5

    b38dbe940b414bc631808a3b19c44843

  • SHA1

    e0a4e7e412e7d7d18c5277655e29f199ec4f208e

  • SHA256

    9dc5af1ed69fcf18edbd5658cdb7905f3c133eaa2b420e0676a13806b1964d96

  • SHA512

    228509dd5b6662de8ffd5ffe878618becfc8c4c5722323fb45d768f33fce05c30397f1b34e817a10528a9f5234d263d17b0bd49c375f8593e480db4430221494

  • SSDEEP

    3072:KfKDGDN0K3vMUZr2/DhW8c/S9OC1hE/uJuP8QrW7JNlfo:0KDGDB3vCbR9p02p97e

Score
10/10
isfb7714gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7714

C2

checklist.skype.com

5.44.43.17

31.41.44.108

62.173.138.213

109.248.11.174
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 2872-138-0x0000000000400000-0x0000000002B0F000-memory.dmp
    .exe windows x86


    Headers

    Sections