General
-
Target
2016-56-0x00000000003D0000-0x00000000003DD000-memory.dmp
-
Size
52KB
-
MD5
c8c9f4a3ae38acbe92b858308bb0b7c8
-
SHA1
6d51e67fbfa27b745625c57a56cc6a9a075eaa84
-
SHA256
c7deabb041ef1c2e79e2a59a2738bc7c398133e936d0b483e3b5d1c4adc74019
-
SHA512
7483a13e1e1daa3420ab2f4c853ff4db919b02dbd3a542051891ff9461358ac0f9115fb5f998b2eb5e736db9bec7ae83b7d5b281f0e5b65e0be5fdd9cc97b1ec
-
SSDEEP
1536:oiVq6pX/MAOnThF/WJdF0udMkJD1Gc4d:Hq69JOnThF/yfdMQ1G9d
Score
10/10
Malware Config
Extracted
Family
gozi
Botnet
7710
C2
checklist.skype.com
62.173.140.103
31.41.44.63
46.8.19.239
185.77.96.40
46.8.19.116
31.41.44.48
62.173.139.11
62.173.138.251
Attributes
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi family
Files
-
2016-56-0x00000000003D0000-0x00000000003DD000-memory.dmp
Headers
Sections