General
-
Target
1480-56-0x0000000000400000-0x0000000002BBD000-memory.dmp
-
Size
39.7MB
-
MD5
957668dd6526893880a7901c5906329e
-
SHA1
2c8185c93afea3aae346069126ec787983a0c5c9
-
SHA256
58ccdd8480930f40dc574005aa7874dde03cb48f9778e9fb68424d05abb91067
-
SHA512
b79c40dba482310ce109645d3fb04fb93f4da188263d5a2e17bcd2c2f5a2f0d3ecd07775ef8ebe645794283ed8c68d68f6137790ec0825ab4f2cbd7da7309ee4
-
SSDEEP
3072:nfKgnKUZekHml9jSCwgay6bipTussKu5fC9/vXws+bu9pJSOVIgyEFebujnK7KzF:fKgKH7l9Mq6g+VJC1fws+bu9p5VnXDz
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
7710
C2
checklist.skype.com
62.173.140.103
31.41.44.63
46.8.19.239
185.77.96.40
46.8.19.116
31.41.44.48
62.173.139.11
62.173.138.251
Attributes
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi family
Files
-
1480-56-0x0000000000400000-0x0000000002BBD000-memory.dmp
Headers
Sections