Overview

overview

10

Static

static

3

b8299962f9...18.exe

windows7-x64

10

b8299962f9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8299962f91574e5e55df6b185ca1863_JaffaCakes118

  • Size

    435KB

  • Sample

    240617-ml8cnsxajd

  • MD5

    b8299962f91574e5e55df6b185ca1863

  • SHA1

    183cf913b5e49a6afafc9f8fa64b13dd43694ad3

  • SHA256

    323601b883c4efcdfedf91176a6cd3aa74bb1f74430ccaf74ffb7712862bd1f0

  • SHA512

    67acec1a142453d99c2b1b13a5fd252b91cd9de3f991fc729a4284712a68af25b9bec5e1a18a03c9118c1f06b2dbee649dfd7e962b7a0e8fab64c4370f77b2bf

  • SSDEEP

    6144:Jas7AFNN4R0Nt4Ca3ge9bZk4tqT+Gh1oHZNCtKtrOm4su4aNZhzD9F:N7AFNN4+Nt4r59tkhPwntrO4a79BF

Score
10/10
gozi3533bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214107

Extracted

Family

gozi

Botnet

3533

C2

gmail.com

google.com

s82dortha27r.top

qcnick5990.top

sd6eb.com
Attributes
  • build

    214107

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      b8299962f91574e5e55df6b185ca1863_JaffaCakes118

    • Size

      435KB

    • MD5

      b8299962f91574e5e55df6b185ca1863

    • SHA1

      183cf913b5e49a6afafc9f8fa64b13dd43694ad3

    • SHA256

      323601b883c4efcdfedf91176a6cd3aa74bb1f74430ccaf74ffb7712862bd1f0

    • SHA512

      67acec1a142453d99c2b1b13a5fd252b91cd9de3f991fc729a4284712a68af25b9bec5e1a18a03c9118c1f06b2dbee649dfd7e962b7a0e8fab64c4370f77b2bf

    • SSDEEP

      6144:Jas7AFNN4R0Nt4Ca3ge9bZk4tqT+Gh1oHZNCtKtrOm4su4aNZhzD9F:N7AFNN4+Nt4r59tkhPwntrO4a79BF

    Score
    10/10
    gozi3533bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks