General

  • Target

    1972-56-0x0000000000400000-0x0000000002BBD000-memory.dmp

  • Size

    39.7MB

  • Sample

    240302-nbmtnada24

  • MD5

    e7c0126e096de61720a6fda01d7c0e4d

  • SHA1

    24f6514c447b2b69b71bd2dfc023f08fd9d17f59

  • SHA256

    37701f45177ca2f67fff9459516281eb0c83ff86a60070b8d2d0af4912787692

  • SHA512

    a4a4fa09523dfa1113262b68742a527de4526c4628b99a98a5c3cb5c781279ca75c889a3c8a622aad9d6b60f6e1146e3269b3ef8cbb552f3e2d0f0eec2ce0936

  • SSDEEP

    3072:nfK+nKUZekHml9jSCwdK0pMtplVDPZhbYxGA4T7q2qlBfeeG55g2GWzYn8clInYh:fK+KH7l9MdnpYDwxm7q1lBfT2GWlPc

Score
10/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7710

C2

checklist.skype.com

62.173.140.103

31.41.44.63

46.8.19.239

185.77.96.40

46.8.19.116

31.41.44.48

62.173.139.11

62.173.138.251

Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      1972-56-0x0000000000400000-0x0000000002BBD000-memory.dmp

    • Size

      39.7MB

    • MD5

      e7c0126e096de61720a6fda01d7c0e4d

    • SHA1

      24f6514c447b2b69b71bd2dfc023f08fd9d17f59

    • SHA256

      37701f45177ca2f67fff9459516281eb0c83ff86a60070b8d2d0af4912787692

    • SHA512

      a4a4fa09523dfa1113262b68742a527de4526c4628b99a98a5c3cb5c781279ca75c889a3c8a622aad9d6b60f6e1146e3269b3ef8cbb552f3e2d0f0eec2ce0936

    • SSDEEP

      3072:nfK+nKUZekHml9jSCwdK0pMtplVDPZhbYxGA4T7q2qlBfeeG55g2GWzYn8clInYh:fK+KH7l9MdnpYDwxm7q1lBfT2GWlPc

    Score
    3/10

MITRE ATT&CK Matrix

Tasks