General

  • Target

    1296-57-0x0000000010000000-0x000000001000E000-memory.dmp

  • Size

    56KB

  • MD5

    a2e62f761dc13bf6af425537c310c719

  • SHA1

    e8b3b8f37cf9b460ba23dfc098a1b57dd60a01a9

  • SHA256

    8fe914a963577e3fb928ce5cb31c7e30a0b7a2cca793312166f993ac1fd0390d

  • SHA512

    48cdcac8f7538a4f79c6179bfd1ffdcad1f661cc84fdbf8b9102f523142c217e362f5d1841da22e68ec0a585ee9ff20d93d2f9b304197c5c4932dd1f44b3893b

  • SSDEEP

    768:A2PrU7eukUXM7dSVvWTyTdcNtW2RTYBfx6w39rDE3Lkjx2K/ZK38u5:laeuZM70sTqdeD8B56w39HE384h38K

Score
10/10

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com

37.120.206.71

37.120.206.84

193.106.191.163

Attributes
  • base_path

    /drew/

  • build

    250240

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1296-57-0x0000000010000000-0x000000001000E000-memory.dmp
    .dll windows x86


    Headers

    Sections