General
-
Target
3052-56-0x000000001B2D0000-0x000000001B30D000-memory.dmp
-
Size
244KB
-
Sample
231003-p6pr6sag6x
-
MD5
7e4eafee9d8c5fdb485d4e1db9b29c7a
-
SHA1
b0d69ddfc4069f783f1c55ac26316ef4132f01b7
-
SHA256
2c34839dc171a6f0e666bc3ca4972967859c76421a712699e3e391a2ac7000b7
-
SHA512
91ff70f2144cbd5cce5e24478afd0d185f301aabfa65fe785e035b25f380161675f79b6bb7f5b72f0b71fe9f85d63fb1fdc71da3d938b823be895d5b165b9c93
-
SSDEEP
3072:eXmwJT25VVeVqX++WldhnUaA4KT6ntfZFSumtYpFQrxlsCuXSTFCr5IcjdyVb5W6:eX72v82Wldh1KeRFSbaWrxlslr5S5G
Malware Config
Extracted
Family
gozi
Botnet
5050
C2
expirew.com
whofos.com
onlinepoints.online
onlinepoints.top
Attributes
-
base_path
/pictures/
-
exe_type
worker
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain