Overview

overview

10

Static

static

3

dce10e2eaf...18.dll

windows7-x64

10

dce10e2eaf...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dce10e2eaf5ff6675f79dafc870da0cd_JaffaCakes118

  • Size

    606KB

  • Sample

    240406-gkv33aca9z

  • MD5

    dce10e2eaf5ff6675f79dafc870da0cd

  • SHA1

    7bcb07ecca4b540c17b4a9a6192b78d2212c117d

  • SHA256

    5c0d5dbdcefeb286689dc07a6a0a405a491e1ccb31cf4b945a245370ace5747a

  • SHA512

    d9197778e5d0a766defc504178666d384678893b85a69712df9aa3b7c379f4f0c570afd3246c817640cec9d149cf0a49cc2682ca627d1cb98ec193057f1ed869

  • SSDEEP

    12288:/8dajLSIFcqRfyo4Tf89UtoM+YD3h0QYDpnynKZ0febiL+eMq6FiIaRzrg:Roqpyo4TfmUtoMapy60feKQiI4

Score
10/10
gozi5566bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5566

C2

outlook.com

peajame.com

gderrrpololo.net
Attributes
  • base_path

    /glik/

  • build

    250211

  • dga_season

    10

  • exe_type

    loader

  • extension

    .lwe

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      dce10e2eaf5ff6675f79dafc870da0cd_JaffaCakes118

    • Size

      606KB

    • MD5

      dce10e2eaf5ff6675f79dafc870da0cd

    • SHA1

      7bcb07ecca4b540c17b4a9a6192b78d2212c117d

    • SHA256

      5c0d5dbdcefeb286689dc07a6a0a405a491e1ccb31cf4b945a245370ace5747a

    • SHA512

      d9197778e5d0a766defc504178666d384678893b85a69712df9aa3b7c379f4f0c570afd3246c817640cec9d149cf0a49cc2682ca627d1cb98ec193057f1ed869

    • SSDEEP

      12288:/8dajLSIFcqRfyo4Tf89UtoM+YD3h0QYDpnynKZ0febiL+eMq6FiIaRzrg:Roqpyo4TfmUtoMapy60feKQiI4

    Score
    10/10
    gozi5566bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks