Overview

overview

10

Static

static

7

f5494f6162...18.exe

windows7-x64

10

f5494f6162...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5494f61627c8c101b403c2a3bbb5f78_JaffaCakes118

  • Size

    5.3MB

  • Sample

    240417-jdtmrsgh72

  • MD5

    f5494f61627c8c101b403c2a3bbb5f78

  • SHA1

    2d063af93542577090b87a7f58335bff7c1b6bc4

  • SHA256

    d108229624c2c0b37b36268cbac9ceb8e5f9f9b25de4b555254cc1faf662576f

  • SHA512

    e5322d544b2a05c4c9fefd6adf87b82bb4d69a28e23bcc4a4c73cda19d25d9913bc4d921481f78e4248909dd4d7e27dedbba3e4e653df4b950b72a869be5e75d

  • SSDEEP

    98304:VxZtsVLiEf+J2xQ9n4EMWabb//0SFj7XwzbyJYsbkzBhtxuLngE4EMWabb//0SFV:VKVL1Q5MWY/02YzQby3ruk4MWY/02YzI

Score
10/10
gozibankerisfbtrojanupx

Malware Config

Extracted

Family

gozi

Targets

    • Target

      f5494f61627c8c101b403c2a3bbb5f78_JaffaCakes118

    • Size

      5.3MB

    • MD5

      f5494f61627c8c101b403c2a3bbb5f78

    • SHA1

      2d063af93542577090b87a7f58335bff7c1b6bc4

    • SHA256

      d108229624c2c0b37b36268cbac9ceb8e5f9f9b25de4b555254cc1faf662576f

    • SHA512

      e5322d544b2a05c4c9fefd6adf87b82bb4d69a28e23bcc4a4c73cda19d25d9913bc4d921481f78e4248909dd4d7e27dedbba3e4e653df4b950b72a869be5e75d

    • SSDEEP

      98304:VxZtsVLiEf+J2xQ9n4EMWabb//0SFj7XwzbyJYsbkzBhtxuLngE4EMWabb//0SFV:VKVL1Q5MWY/02YzQby3ruk4MWY/02YzI

    Score
    10/10
    gozibankerisfbtrojanupx

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks