General

  • Target

    368-138-0x0000000000400000-0x000000000044C000-memory.dmp

  • Size

    304KB

  • MD5

    c1215b65f4e93e4890a0cda5d1cd6fa2

  • SHA1

    49547ded60c2b660c2903bb7d111fb7299f1b0f8

  • SHA256

    f217ce9961c4c0b3a9da53d565d26ec4c6a476f7d4be0b8abd27c8d467e33cdc

  • SHA512

    4475a17b2050b7cb4981f1cb8e53574715bee2e8913c055eaeb20a6a5d486f539f3640ceb73df114124fb96823724fa098246f1acf23a73dba6f09620bb29f76

  • SSDEEP

    3072:VfKGprNoVUE3Hn5PlWqUeMV7oog/Mhej01QDn/MmH52c:RKGprOVUuv7UnVU/0hS01QD/

Score
10/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7711

C2

checklist.skype.com

62.173.138.6

89.117.37.146

46.8.210.82

89.116.227.15

31.41.44.51

Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 368-138-0x0000000000400000-0x000000000044C000-memory.dmp
    .exe windows x86


    Headers

    Sections