General
-
Target
1732-81-0x000000001B9D0000-0x000000001BA0D000-memory.dmp
-
Size
244KB
-
Sample
231011-bdejvahd6z
-
MD5
ee7e38c8403a6dee6f8cffb492725cbe
-
SHA1
5100222210bd98e7ab887a8a1218efe8dd7f4a25
-
SHA256
b2c62d3e5ce714bd3628efb1c0cf0e001379abce31e1b72e9d1508ec2bbba9c3
-
SHA512
630d10d03710b86d95158cf10cd10aba6cd719e77b39ccc856e6a4a7163dd75eb83c8f84bea8c6b90d97385bb6d7e88e194f86e4839c3a7d8066147ac075869e
-
SSDEEP
3072:vXmwJT25VVeVqX++WldhnUaA4KT6ntfZFSumtYpFQrxlsGXSTFCr5IcjGvFRD9J8:vX72v82Wldh1KeRFSbaWrxlsGr5a5Gl
Malware Config
Extracted
Family
gozi
Botnet
5050
C2
http://igrovdow.com
Attributes
-
base_path
/pictures/
-
exe_type
worker
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain