General
-
Target
1324-60-0x0000017DF3380000-0x0000017DF33BD000-memory.dmp
-
Size
244KB
-
Sample
231010-zalezshe5z
-
MD5
425cd09bef0c01e4e2ba55efa65b0bfe
-
SHA1
1a5d23907a0490c2a48dccb6c6dbe8d8fe05077b
-
SHA256
5782a6ea0bc906b5f3cca4fca700124d264b90d812cdd446dc5cc063403d55a5
-
SHA512
cc30cda8f4971f238426295538f3b9161c9aac3ebe4f0b434ee4742c603e138510b503e9781d15c01cb2dc05fb891b10fc2c61a58489ee60b550e55768c187c0
-
SSDEEP
6144:DX72v82Wldh1KeRFSbaWrxlsWr5nrr5G:DL2v8znYSSeWr4W
Malware Config
Extracted
Family
gozi
Botnet
5050
C2
31.41.44.79
185.248.144.203
netsecurez.com
whofoxy.com
Attributes
-
base_path
/pictures/
-
exe_type
worker
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain