General

  • Target

    1520-59-0x0000021FEC3E0000-0x0000021FEC41D000-memory.dmp

  • Size

    244KB

  • Sample

    230928-sh2zdacc8v

  • MD5

    bccca99c313207ca9efb5c0fd5d3d5de

  • SHA1

    30ea7ed5ced963ea1befaeef46659cfb2788c4da

  • SHA256

    07eae4efd7f5e98413d46b61ef2ca82a81249b4979a48a0cd78c40b0fd8b53ff

  • SHA512

    5f6be099f6423b41f2e6cc25d5ed37a3059642bbe1733f3a33f9e2bfba2cb11ff316a05fb7410dd051615fdac63364e00b25c8a6f837c9cce984e684b0ee5dfd

  • SSDEEP

    6144:bX72v82Wldh1KeRFSbaWrxlsLr5rzy3C5G:bL2v8znYSSeWr4Lhzy3

Score
10/10

Malware Config

Extracted

Family

gozi

Botnet

5050

C2

31.41.44.79

185.248.144.203

netsecurez.com

whofoxy.com

Attributes
  • base_path

    /pictures/

  • exe_type

    worker

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    Tasks