General
-
Target
4216-149-0x0000000000400000-0x000000000040D000-memory.dmp
-
Size
52KB
-
MD5
3b81e7d0de74cd09d71134e68fca60c4
-
SHA1
554e198109d815f8ae9724f60d2d84226e28b201
-
SHA256
f10b219592492257675caad117cab224157d0d96e22970fcc0be8ad686e6b756
-
SHA512
10553060209e214c1803b28f051dded3f0addbf504e6aea0c283f9bb06bc3d91ff74bb49ce89c18348117a32f925d250c4f8aef67bb48e058e52b8949a10bdc4
-
SSDEEP
768:6KbMPv5JLcymyV34OB9bl5n+iRjn9P1avZa9Bmr1h097mI5ce:64MHLLcRyt5+0zavZangX097m1
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
7704
C2
checklist.skype.com
62.173.149.202
31.41.44.158
193.0.178.157
Attributes
-
base_path
/drew/
-
build
250249
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi family
Files
-
4216-149-0x0000000000400000-0x000000000040D000-memory.dmp
Headers
Sections