General
-
Target
2008-56-0x00000000002D0000-0x00000000002DD000-memory.dmp
-
Size
52KB
-
MD5
e49be7ba938ab988932c3be1a15381a9
-
SHA1
1f39bae35aaebae9861df013d473e7993685ad97
-
SHA256
dc5392a5206ca087212725a23cfa457f0871527cd1940914478b799098f5cb78
-
SHA512
0c2c17b15a37def7a78f97543fe8878e6c1fe3f733326d1919c0982c556785caa40632d21adc5fe3b60e4982c86535c4f79f1b0d19261d55bf11a61a2689a441
-
SSDEEP
1536:o6Bnlqajb/swSL3zRwppNVcD9dMWD1Gc4d:Flq4Z+3zRwNgdMw1G9d
Score
10/10
Malware Config
Extracted
Family
gozi
Botnet
7710
C2
checklist.skype.com
62.173.140.103
31.41.44.63
46.8.19.239
185.77.96.40
46.8.19.116
31.41.44.48
62.173.139.11
62.173.138.251
Attributes
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi family
Files
-
2008-56-0x00000000002D0000-0x00000000002DD000-memory.dmp
Headers
Sections