Overview

overview

10

Static

static

7

f805985485...18.exe

windows7-x64

10

f805985485...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f805985485adc1b5ca2a59e0efbb40a2_JaffaCakes118

  • Size

    5.8MB

  • Sample

    240418-p1d4gsef2s

  • MD5

    f805985485adc1b5ca2a59e0efbb40a2

  • SHA1

    c4a342bf97880131fecf2cd6bdb015bf50775b83

  • SHA256

    3edf80e36f729e75814a04e96772a31b10891f75475df564bd6b02d207a84f39

  • SHA512

    aea6ed5a103d240b0a0f5f59b48a7ea4ec6bfc08015096160766bd9743321f752123de6fa02c7daac2f5dee36ac013aa0643322c9e9b45750443f1954ab92dbf

  • SSDEEP

    98304:2IbHUlkFpLogg3gnl/IVUs1jePszPTYzw4SJc1gg3gnl/IVUs1jePs:2aUWvggl/iBiP6Ub1gl/iBiP

Score
10/10
gozibankerisfbtrojanupx

Malware Config

Extracted

Family

gozi

Targets

    • Target

      f805985485adc1b5ca2a59e0efbb40a2_JaffaCakes118

    • Size

      5.8MB

    • MD5

      f805985485adc1b5ca2a59e0efbb40a2

    • SHA1

      c4a342bf97880131fecf2cd6bdb015bf50775b83

    • SHA256

      3edf80e36f729e75814a04e96772a31b10891f75475df564bd6b02d207a84f39

    • SHA512

      aea6ed5a103d240b0a0f5f59b48a7ea4ec6bfc08015096160766bd9743321f752123de6fa02c7daac2f5dee36ac013aa0643322c9e9b45750443f1954ab92dbf

    • SSDEEP

      98304:2IbHUlkFpLogg3gnl/IVUs1jePszPTYzw4SJc1gg3gnl/IVUs1jePs:2aUWvggl/iBiP6Ub1gl/iBiP

    Score
    10/10
    gozibankerisfbtrojanupx

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks