General
-
Target
1520-59-0x0000021FEC3E0000-0x0000021FEC41D000-memory.dmp
-
Size
244KB
-
Sample
231011-kvdhjsee92
-
MD5
bccca99c313207ca9efb5c0fd5d3d5de
-
SHA1
30ea7ed5ced963ea1befaeef46659cfb2788c4da
-
SHA256
07eae4efd7f5e98413d46b61ef2ca82a81249b4979a48a0cd78c40b0fd8b53ff
-
SHA512
5f6be099f6423b41f2e6cc25d5ed37a3059642bbe1733f3a33f9e2bfba2cb11ff316a05fb7410dd051615fdac63364e00b25c8a6f837c9cce984e684b0ee5dfd
-
SSDEEP
6144:bX72v82Wldh1KeRFSbaWrxlsLr5rzy3C5G:bL2v8znYSSeWr4Lhzy3
Malware Config
Extracted
Family
gozi
Botnet
5050
C2
31.41.44.79
185.248.144.203
netsecurez.com
whofoxy.com
Attributes
-
base_path
/pictures/
-
exe_type
worker
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain