General
-
Target
2988-135-0x0000000002240000-0x000000000224D000-memory.dmp
-
Size
52KB
-
MD5
b67c94d816589444513fc219de615088
-
SHA1
b6de01465bf82d84bca2e793db91324650b76253
-
SHA256
b4db74aaaf61404dcce214cc2386512260a1442117d7518c38143fcfe95ffb9c
-
SHA512
d5d0f4f52ead68872746851ccb67610d3adcd6e32b8b2a263d2ef8fbe50e881dbff6fcdefc7d30b2aae849f57a7608b68e54d0cc2b4d2a3c4170090c611f5e39
-
SSDEEP
768:GGcKqlvb4i2ho/c4EHvTzWH9PMO5e2QA9IIwc4ldMhhK3D1Gc:GPKqwo/cdvs5MIdwc4ldMeD1Gc
Score
10/10
Malware Config
Extracted
Family
gozi
Botnet
7713
C2
checklist.skype.com
62.173.142.51
94.103.183.153
193.233.175.111
109.248.11.145
31.41.44.106
191.96.251.201
Attributes
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Gozi family
Files
-
2988-135-0x0000000002240000-0x000000000224D000-memory.dmp
Headers
Sections