Overview

overview

10

Static

static

10

2016-56-0x...ry.exe

windows7-x64

1

2016-56-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2016-56-0x0000000000400000-0x00000000004DB000-memory.dmp

  • Size

    876KB

  • MD5

    c599d09eef54cc2dd8537a950f5ecc67

  • SHA1

    09d8fd2f2e4454db15957da958c6c80d9fc630ea

  • SHA256

    a0d2e7dfcf9c6a92e86f0b637b3c40ed3edf99eff9399de5a4b844105099dff7

  • SHA512

    54671210042e4f3c63a7b55dacd0abe924828842a6b6bce5b811d01f53e44be1610550e9dd2df7ba50b852c4ab3cc6eb5d4c72c0d11c37b0103e0450646fda59

  • SSDEEP

    3072:VfK9VNoVUE3HnPmcLRXhA8Bze/mc8yNPFAsWdlS1t7taCutgwn0F:RK9VOVUuvhlPVeh8SEjM4n

Score
10/10
isfb7715gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7715

C2

checklist.skype.com

62.173.142.50

31.41.44.87

109.248.11.217

212.109.218.151

5.44.45.83

62.173.142.81

193.233.175.113

109.248.11.184

212.109.218.26

185.68.93.7
Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 2016-56-0x0000000000400000-0x00000000004DB000-memory.dmp
    .exe windows x86


    Headers

    Sections