General

  • Target

    e300e7c359c3792e263a1de5dfeb6040.bin

  • Size

    155KB

  • Sample

    230309-cb4xdsab39

  • MD5

    91871d5490068fcabb96bd1dfd97dbc3

  • SHA1

    da14460f79f0f6e664705d6fc02a69f1408aad91

  • SHA256

    d225fe96a096eee6b1d31a543a9e3bd9805d80fe4a8bc5194846311df803cb68

  • SHA512

    bc2010c79f791d8e2cb5e69dc7ae61f3b55be017a14b501fea5a0e9a4ade9db618c3194361c5be09f54906e4d8d0126d0d719820d81112cbe2c1709ce8689f2c

  • SSDEEP

    3072:Db98aarFUHkPTmhfXCvh2DOh9C2d/ieoSdZZ8Hj3FG7wUxbFZn3m:N8aap3PTmtXCp2itd/fbZ8HJI3m

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7710

C2

checklist.skype.com

62.173.140.103

31.41.44.63

46.8.19.239

185.77.96.40

46.8.19.116

31.41.44.48

62.173.139.11

62.173.138.251

Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      0c1d1a60a0fc143c9fc830be48c53d488b414921cf4d97d66466ff2a628d1b4d.exe

    • Size

      265KB

    • MD5

      e300e7c359c3792e263a1de5dfeb6040

    • SHA1

      4951349e2d0112fdb7475ac9dfe9825096b972ba

    • SHA256

      0c1d1a60a0fc143c9fc830be48c53d488b414921cf4d97d66466ff2a628d1b4d

    • SHA512

      06a89e44f3864a333d0775436910017e4b953f5af501b3c7f9ce969005854c59371c0a776d0a2fac3bfb853e04b6eed5d86f9eeb6c18996c91f1cb7289c64736

    • SSDEEP

      3072:YiTkTkLBIs1teAyoa09He+O1OcNI9ZFFbzeAlWNwqBO8DdrFFtI4eZov:YhILvPenLb5NI9ZFFneK6/rFLI4eZu

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

MITRE ATT&CK Matrix

Tasks