General

  • Target

    1252-57-0x0000000010000000-0x000000001000E000-memory.dmp

  • Size

    56KB

  • MD5

    fc635bc2ed48cec52f254fe66b848cab

  • SHA1

    3778e2f2d95b055e2833ba2d5e63c24739b8d22b

  • SHA256

    7d7ae317f3ad0ae27aedde1586456a1a1d295dedb5ede9564ab38515eeca2927

  • SHA512

    b7d431911549bea880e058345066b5583f36197d3cbe0a32cfb734e837babb3a82a23dc56e08ff5a880205b68747e5b30da1248da6259db5848adff24680e8fd

  • SSDEEP

    768:A2JrU7eukUXM7d8DVvWPyiYlC0VwS3ADFXpTadRx337aOlBDsvO5P:PaeuZM7csPBqC0V93AtpGX3L/l5sgP

Score
10/10

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com

79.110.52.8

79.110.52.80

193.106.191.163

Attributes
  • base_path

    /drew/

  • build

    250240

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1252-57-0x0000000010000000-0x000000001000E000-memory.dmp
    .dll windows x86


    Headers

    Sections