General
-
Target
4264-135-0x0000000000400000-0x0000000002B9C000-memory.dmp
-
Size
39.6MB
-
MD5
c10b083d29013ca71451d1da21a4ffd4
-
SHA1
32296756047f50a121f374d24d60a8f19fb9e4f4
-
SHA256
d55896aaf176e44f883d60cd0e86aea6da95614e332e154741aace0d3eccc5b4
-
SHA512
05ecf421a46545ffffc960c45b4e672e670d8484b3946e4f3708319698824690f9278be46f74efe7604b8dda8e42c3d4f69f8c66f67103ec3223365ef4c21fc6
-
SSDEEP
3072:SHLe0Pu/6gLT5LRdZn0Gl5lHDInOp00VMUwBNXYzBf6/OKmcTdKralbTl:Sre0PYZn9Zn0AQs0IMUwBNO6/Nlb
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
7702
C2
checklist.skype.com
62.173.138.160
31.41.44.122
193.0.178.141
Attributes
-
base_path
/drew/
-
build
250249
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi family
Files
-
4264-135-0x0000000000400000-0x0000000002B9C000-memory.dmp
Headers
Sections