Overview

overview

10

Static

static

3

a90e5e0e62...18.exe

windows7-x64

10

a90e5e0e62...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a90e5e0e62f381b7c33571353555d41c_JaffaCakes118

  • Size

    363KB

  • Sample

    240614-lv39msygrq

  • MD5

    a90e5e0e62f381b7c33571353555d41c

  • SHA1

    80f1cd388c654df4739e9a080e8d4500bb3a4e1c

  • SHA256

    704c25ad6ae33fd4175745812a1374d5b3fe44b9d3f3b7b17fcd03f2d7eeb148

  • SHA512

    f04e1004c6fb5ee7462f33379e75dfc44660c71ac99f13663d7f500f87c4bd0a71e77d679491380041414e1a4edd8c43198d45dfdce34592156392f9b77c37a7

  • SSDEEP

    6144:jotHqKArIOB2kRdhnIjEJnBdODHEcWpqZoZF7LmNsL38cUlXudTx:jKHIrNbnmEJgWpqqZlqNsLMcUh6x

Score
10/10
gozi3485bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214085

Extracted

Family

gozi

Botnet

3485

C2

google.com

gmail.com

s39aihzlia.com

hqrya64peyton.com

l58er.com
Attributes
  • build

    214085

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      a90e5e0e62f381b7c33571353555d41c_JaffaCakes118

    • Size

      363KB

    • MD5

      a90e5e0e62f381b7c33571353555d41c

    • SHA1

      80f1cd388c654df4739e9a080e8d4500bb3a4e1c

    • SHA256

      704c25ad6ae33fd4175745812a1374d5b3fe44b9d3f3b7b17fcd03f2d7eeb148

    • SHA512

      f04e1004c6fb5ee7462f33379e75dfc44660c71ac99f13663d7f500f87c4bd0a71e77d679491380041414e1a4edd8c43198d45dfdce34592156392f9b77c37a7

    • SSDEEP

      6144:jotHqKArIOB2kRdhnIjEJnBdODHEcWpqZoZF7LmNsL38cUlXudTx:jKHIrNbnmEJgWpqqZlqNsLMcUh6x

    Score
    10/10
    gozibankerisfbtrojan3485

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks