General
-
Target
4464-56-0x000001F9E8700000-0x000001F9E873D000-memory.dmp
-
Size
244KB
-
Sample
231010-v83ppsha56
-
MD5
b8c29d3a81e5e8bc0be77ace42e4f21e
-
SHA1
fae310ce31bd502471d4eac5df9735e3166db6ba
-
SHA256
4809f2e58f6edee57c03e50340578546e2e14bd97268746096c60a4f101190c0
-
SHA512
8258d05c9cf8e2f9b52b16f9b6ebf70dddaf5837294d92a73a598c4901c00e216799f107b8570a749726e4e4a6076ad3e8b3e17d31a131eef1d8db5e6624c274
-
SSDEEP
3072:RXmwJT25VVeVqX++WldhnUaA4KT6ntfZFSumtYpFQrxlso/XSTFCr5Icj5+5Wtl:RX72v82Wldh1KeRFSbaWrxlsSr5u5Gl
Malware Config
Extracted
Family
gozi
Botnet
5050
C2
http://igrovdow.com
Attributes
-
base_path
/pictures/
-
exe_type
worker
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain