Overview

overview

10

Static

static

7

f864811120...18.exe

windows7-x64

7

f864811120...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8648111203980752cf80fca8c5d1561_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240418-ve9wxsaa46

  • MD5

    f8648111203980752cf80fca8c5d1561

  • SHA1

    bff737a4d95c7a969a37f94ffc77437f4094219b

  • SHA256

    5c2b24ca37bfb59391d6ae587f499ac19ab071b022767e3456e9587dba843d2d

  • SHA512

    50ccdf29469feee27bc6f940205c4e42f64324b8751d3c3bedd0108fbabacc3b3f9db7c7283b5c12b05db609876fd2785f071800950a77b6c3311d945d620a1b

  • SSDEEP

    49152:xYbg7Yql7axZXrMHoS4uY+vB2H/WvO+8pSflb2fGXsNzv/PaYj7K4:x0g7Y876NMHoS4dkY/4OLSfUfG8NOYi4

Score
10/10
gozibankerisfbtrojanupx

Malware Config

Extracted

Family

gozi

Targets

    • Target

      f8648111203980752cf80fca8c5d1561_JaffaCakes118

    • Size

      2.9MB

    • MD5

      f8648111203980752cf80fca8c5d1561

    • SHA1

      bff737a4d95c7a969a37f94ffc77437f4094219b

    • SHA256

      5c2b24ca37bfb59391d6ae587f499ac19ab071b022767e3456e9587dba843d2d

    • SHA512

      50ccdf29469feee27bc6f940205c4e42f64324b8751d3c3bedd0108fbabacc3b3f9db7c7283b5c12b05db609876fd2785f071800950a77b6c3311d945d620a1b

    • SSDEEP

      49152:xYbg7Yql7axZXrMHoS4uY+vB2H/WvO+8pSflb2fGXsNzv/PaYj7K4:x0g7Y876NMHoS4dkY/4OLSfUfG8NOYi4

    Score
    10/10
    upxgozibankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks