Overview

overview

10

Static

static

10

2244-2-0x0...ry.exe

windows7-x64

1

2244-2-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2244-2-0x0000000000400000-0x0000000000450000-memory.dmp

  • Size

    320KB

  • MD5

    20ddaefa8d343b2a16f2db05d882ae55

  • SHA1

    ccfc5a7b2643f4eb18559095eccf99c329f840dd

  • SHA256

    9b69330d6bdd5da85fccdb49158f86a8d85e83a69c425af9c649ad0168032488

  • SHA512

    e13abcb2425639a4040fc5e74b28d0445906ee7d23d7ded583bd19b57e8c0ff0545bebf5effd494e8bff3516366735b815dc4e0011782c32ece9347bde66182a

  • SSDEEP

    6144:uu1U5RGJr5ffE31kwsQODpAkVyakH7pWMxNTf:34wTf8lDsQsVyaOt5

Score
10/10
isfb5050gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

netsecurez.com

whofoxy.com

mimemoa.com

ntcgo.com
Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2244-2-0x0000000000400000-0x0000000000450000-memory.dmp
    .exe windows:5 windows x86


    Headers

    Sections