General

  • Target

    1004-57-0x0000000010000000-0x000000001000E000-memory.dmp

  • Size

    56KB

  • MD5

    ddda82e8562eee55624a2ba724439ed7

  • SHA1

    9811af927e98c462a1b43c1b7401d02596d943d5

  • SHA256

    816bdd0552529fde179cc7563fe853bc9d7c9cd7fa5050145abdce2972036c6c

  • SHA512

    2101e569861649373686e50eecbad54042dfc4d495fbc426b1d895766af6d45d78b4994da33c2aa688bc4fc34ced53ec4df99527c803df03d06d9de05e435409

  • SSDEEP

    768:A2PrU7eukUXM7dJVvWTyTdcNtW2RTYBfx6w39rDE3Lkjx2K/ZK38u5:laeuZM7jsTqdeD8B56w39HE384h38K

Score
10/10

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com

37.120.206.71

37.120.206.84

193.106.191.163

Attributes
  • base_path

    /drew/

  • build

    250240

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1004-57-0x0000000010000000-0x000000001000E000-memory.dmp
    .dll windows x86


    Headers

    Sections