Overview

overview

10

Static

static

10

2308-2-0x0...ry.exe

windows7-x64

1

2308-2-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2308-2-0x0000000000400000-0x000000000044A000-memory.dmp

  • Size

    296KB

  • MD5

    86b4a130cb6381b4fb375c99adf7b334

  • SHA1

    2a9f40a2bea5465f94a99245452e2b1b4b864d3b

  • SHA256

    bb2ad13ca35fc7fd3334d16c02852429733f18a00e76ea199ec15797da8074af

  • SHA512

    69fba30ca8a5d6d666031ff840bd6bda2d0dd35067429081efaa699865f4158a0f88f28abe346ced7270d560bca6f0f423d02fc57e2fd5dd409f116b6a255409

  • SSDEEP

    3072:KrPI5jSu1UtEPrYLubTtT+MXpZSylO6d1v01wtialvaTAIns5chZTrbp:iu1UtEPr7ftznPO6dVQWIBjTJ

Score
10/10
isfb5050gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

31.41.44.28

146.19.233.250

46.8.19.158
Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2308-2-0x0000000000400000-0x000000000044A000-memory.dmp
    .exe windows:5 windows x86


    Headers

    Sections