General
-
Target
1368-56-0x00000000002D0000-0x00000000002DD000-memory.dmp
-
Size
52KB
-
MD5
a9b2014e2a24c7d95a48d4cb87603883
-
SHA1
a5cdb5ebeeea15a183374c675a7d4ab994088d29
-
SHA256
612411cee8df84e8bbb4de141d842ed8cf71c75cecdc89f49043b7abed39462e
-
SHA512
46daa4fbbde535a15c488b199a81c8db2a67110ca9fb35459f8661f350d3c9c6530ba44f409364001d5817572a7c7c4369b8daaa877d972911631f9c23a73265
-
SSDEEP
1536:o6Bnlqajb/swSL3zRwppNVcD9dMWD1Gc4d:Flq4Z+3zRwNQdMw1G9d
Score
10/10
Malware Config
Extracted
Family
gozi
Botnet
7710
C2
checklist.skype.com
62.173.140.103
31.41.44.63
46.8.19.239
185.77.96.40
46.8.19.116
31.41.44.48
62.173.139.11
62.173.138.251
Attributes
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi family
Files
-
1368-56-0x00000000002D0000-0x00000000002DD000-memory.dmp
Headers
Sections