General
-
Target
3076-135-0x0000000002CF0000-0x0000000002CFD000-memory.dmp
-
Size
52KB
-
MD5
a5a0299d1f4184ffebdadae70433126f
-
SHA1
cd6bfae01bbe9b3a727f36f366ffb86700443e79
-
SHA256
b37de131a649856caeb0d2368306c193593e4a4e22e56bededb9bccfd485597f
-
SHA512
2b55e511e51773d9fd18b64ee46151163ac0fab0b136b12f68a3c044f6e964db52f6612cf392629d86ff9b9fbc36a95aeb404ebe71cd2f423be85b1a184550cd
-
SSDEEP
768:vpspqvzvGcev/I4hCuSHqcTBoBjSVvoraBod/V497DdMJ7hK3D1Gc:vqpqiv/IoCrntxveRd/V07DdMOD1Gc
Score
10/10
Malware Config
Extracted
Family
gozi
Botnet
7709
C2
checklist.skype.com
62.173.141.252
31.41.44.33
109.248.11.112
Attributes
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi family
Files
-
3076-135-0x0000000002CF0000-0x0000000002CFD000-memory.dmp
Headers
Sections