Overview

overview

10

Static

static

3

bc4d2fd23a...18.exe

windows7-x64

10

bc4d2fd23a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc4d2fd23a3ca94216443cea23381b54_JaffaCakes118

  • Size

    816KB

  • Sample

    240618-q8q9fswfqc

  • MD5

    bc4d2fd23a3ca94216443cea23381b54

  • SHA1

    7f3c793c3c6414d223f5ce7d5090bb9dc2dcd709

  • SHA256

    34e6ca7fcd9b02405980bd6a92e20b8f972b0988e90576135c4ce12216f12f7e

  • SHA512

    4f7ede4877feccbeb063cf7a2c9bcfe5c9e31f0336800f92c42259153724682599d466aa7500f344c6c370e3b300b3dc3ee4212f00b655bddc2a79fbafe0d5e9

  • SSDEEP

    12288:6crq243ICNz1TJ987E77JALCkUBmke6dfDKT2UD4w3E1/JoV0TCV+Z:6e4d1q7o7Bkz3NDSpyG6+Z

Score
10/10
gozi1000bankercollectionisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1000

C2

purbs.com

makarcheck.com
Attributes
  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      bc4d2fd23a3ca94216443cea23381b54_JaffaCakes118

    • Size

      816KB

    • MD5

      bc4d2fd23a3ca94216443cea23381b54

    • SHA1

      7f3c793c3c6414d223f5ce7d5090bb9dc2dcd709

    • SHA256

      34e6ca7fcd9b02405980bd6a92e20b8f972b0988e90576135c4ce12216f12f7e

    • SHA512

      4f7ede4877feccbeb063cf7a2c9bcfe5c9e31f0336800f92c42259153724682599d466aa7500f344c6c370e3b300b3dc3ee4212f00b655bddc2a79fbafe0d5e9

    • SSDEEP

      12288:6crq243ICNz1TJ987E77JALCkUBmke6dfDKT2UD4w3E1/JoV0TCV+Z:6e4d1q7o7Bkz3NDSpyG6+Z

    Score
    10/10
    gozi1000bankercollectionisfbpersistencetrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Active Setup

1
T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Active Setup

1
T1547.014

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Remote System Discovery

1
T1018

Process Discovery

1
T1057

Lateral Movement

Collection

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks