General
-
Target
1476-56-0x0000000000400000-0x0000000002BBD000-memory.dmp
-
Size
39.7MB
-
MD5
d81981512b9e0fac22dada4490f6b4d3
-
SHA1
869a00fbf64970ab21945bbb4b0846ee487ac5d7
-
SHA256
104b4f9e694ea1f0841f55812dd0ddf21fb46a8f19fcfad1b88019932811a55a
-
SHA512
9034e0db68473779d97008ade582de09ad13f00128672fad5719899dfb3345a8bf619772b202c0ebe9c95ec96bf961d8f441e36cf724ec8d1a5d4543275ccba2
-
SSDEEP
3072:nfKdnKUZekHml9jSCwUaS4QirQo7GImj49BK5nW+HHQ3k0TfWupeU5DLK6PpUqsw:fKdKH7l9Mu4rQ63ByqjfH5DLKc+qd
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
7710
C2
checklist.skype.com
62.173.140.103
31.41.44.63
46.8.19.239
185.77.96.40
46.8.19.116
31.41.44.48
62.173.139.11
62.173.138.251
Attributes
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi family
Files
-
1476-56-0x0000000000400000-0x0000000002BBD000-memory.dmp
Headers
Sections