General

  • Target

    1972-56-0x0000000000400000-0x0000000002BBE000-memory.dmp

  • Size

    39.7MB

  • Sample

    240302-mzwk2ach24

  • MD5

    e853b0af06d611fd43fcfddbc9706534

  • SHA1

    452e34eb0fde456643d3e7259301e5dff8916448

  • SHA256

    b2efaea1b72de2eec9f7c2625865c5a91ed64fa61c82c07fea9ca21494e2c3df

  • SHA512

    017b3b5baa3daa89e744b23e680705d0de6a5e85b5de05b9d8b6950608be81472335623a6ab4384f5798a951a86fd3092ce5c1143f0a7b25c7b7b65b14affdd5

  • SSDEEP

    3072:nfKonKUZekHml9jSCwIafmuaXZuss3utDMZDXvCXzdVKu6HRGayjGZEOF:fKoKH7l9MvmlA3uWFXvSM98aeE

Score
10/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7710

C2

checklist.skype.com

62.173.140.103

31.41.44.63

46.8.19.239

185.77.96.40

46.8.19.116

31.41.44.48

62.173.139.11

62.173.138.251

Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      1972-56-0x0000000000400000-0x0000000002BBE000-memory.dmp

    • Size

      39.7MB

    • MD5

      e853b0af06d611fd43fcfddbc9706534

    • SHA1

      452e34eb0fde456643d3e7259301e5dff8916448

    • SHA256

      b2efaea1b72de2eec9f7c2625865c5a91ed64fa61c82c07fea9ca21494e2c3df

    • SHA512

      017b3b5baa3daa89e744b23e680705d0de6a5e85b5de05b9d8b6950608be81472335623a6ab4384f5798a951a86fd3092ce5c1143f0a7b25c7b7b65b14affdd5

    • SSDEEP

      3072:nfKonKUZekHml9jSCwIafmuaXZuss3utDMZDXvCXzdVKu6HRGayjGZEOF:fKoKH7l9MvmlA3uWFXvSM98aeE

    Score
    3/10

MITRE ATT&CK Matrix

Tasks