General

  • Target

    contratto.zip

  • Size

    478B

  • Sample

    230309-j5anzabc93

  • MD5

    ebbe6434b8d6ab9439c69218f6513fbb

  • SHA1

    4abb5e3486546ac452b99d3b04079b810f151ee0

  • SHA256

    120b092e8d8212a7c0e796ac320dd10c56c8b801aa8fb234cb577d5f0dabc05c

  • SHA512

    d5a7fbae35071dcc4826a87e26bb8dc4fe21816b0c2f905f219ce820f3972c7cf83c4ff3a65567eda5aaec87e4f2816306c1b4fe7ff2699c88fcca7be077fa02

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7712

C2

checklist.skype.com

62.173.141.36

31.41.44.85

193.233.175.98

46.8.210.110

89.116.227.49

Attributes
  • base_path

    /drew/

  • build

    250255

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      contratto/contratto.url

    • Size

      191B

    • MD5

      c57ce09111a84d1110b24a8505ff5804

    • SHA1

      9fd1e2577f10a24c2678803e073d35e41b551eb2

    • SHA256

      257413c17f63500a76f9d0216a8dee283021299a61dc0539e6e870fd5d78177b

    • SHA512

      71cf1e5d069a75be84cfcaf82479fb037e75055c05e94ad212453769288b1e3b194156fad802619b0850c9e9abb3c045600779de234b8b51505b1a54f46b7c84

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v6

Tasks