gozi | 9ee54571151efbd253a30211dbe7beaf57aca1b1ed8aae48de72f83d43897c3d | Triage

Submit
Reports

Overview

overview

Static

static

3

ac7bc5c495...18.exe

windows7-x64

ac7bc5c495...18.exe

windows10-2004-x64

Sharing

General

Target

ac7bc5c4953f3cdf488f98d2bdfe0bf9_JaffaCakes118
Size

268KB
Sample

240615-b9kezayfjr
MD5

ac7bc5c4953f3cdf488f98d2bdfe0bf9
SHA1

8dcc3ffa6aed4b42990d63248db3621e2165d9ac
SHA256

9ee54571151efbd253a30211dbe7beaf57aca1b1ed8aae48de72f83d43897c3d
SHA512

2a25edece0a2ebb8cf8cae2cad742968b09160eaa7a6cbafb3d83a6f62b642efed041f3d9aacf26135125db491032e2385a1139d6c976e362cae3a4fd78c6117
SSDEEP

6144:bjGlumlDoFoiADf3N5uYU6REjMmgJpUgiT:bjG8mOF9C/N5uYUdjMmaziT

Score

10^/10

gozi 6000 banker isfb trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ac7bc5c4953f3cdf488f98d2bdfe0bf9_JaffaCakes118.exe

Resource

win7-20240508-en

gozi 6000 banker isfb trojan

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

ac7bc5c4953f3cdf488f98d2bdfe0bf9_JaffaCakes118.exe

Resource

win10v2004-20240226-en

gozi 6000 banker isfb trojan

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Extracted

Family

gozi

Botnet

6000

C2

http://velooiisd.club

Attributes

build
214082
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Extracted

Family

gozi

Attributes

build
214082

Targets

- Target
  
  ac7bc5c4953f3cdf488f98d2bdfe0bf9_JaffaCakes118
- Size
  
  268KB
- MD5
  
  ac7bc5c4953f3cdf488f98d2bdfe0bf9
- SHA1
  
  8dcc3ffa6aed4b42990d63248db3621e2165d9ac
- SHA256
  
  9ee54571151efbd253a30211dbe7beaf57aca1b1ed8aae48de72f83d43897c3d
- SHA512
  
  2a25edece0a2ebb8cf8cae2cad742968b09160eaa7a6cbafb3d83a6f62b642efed041f3d9aacf26135125db491032e2385a1139d6c976e362cae3a4fd78c6117
- SSDEEP
  
  6144:bjGlumlDoFoiADf3N5uYU6REjMmgJpUgiT:bjG8mOF9C/N5uYUdjMmaziT
Score

10^/10

gozi 6000 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

gozi6000bankerisfbtrojan

behavioral2

gozi6000bankerisfbtrojan

© 2018-2024

Terms | Privacy