Overview

overview

10

Static

static

7

fd6a2837f4...18.exe

windows7-x64

10

fd6a2837f4...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd6a2837f471b90aebdff7d493ce519a_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240420-xl8zbafh3z

  • MD5

    fd6a2837f471b90aebdff7d493ce519a

  • SHA1

    c57e035e23296200f0ae76fc6c8b84c3db37587e

  • SHA256

    655da3e3009d3bbe19fce8d2913f11e8afd61d7b567a01f7421b4253230758a6

  • SHA512

    78af260a558caf77a232546d0e8c8af73d948c586ed1e09454ae244c087a86cd48a7bba9087224206ad45601a8fccdb05850ac38d1b04b185acedbcdf33b3421

  • SSDEEP

    49152:IS3+/EyBLQB11vkJ///Im+hqDb3Qv6+9Baj8BBT4SfcsUjoh48TyMPkXdwkyZ:9qLa1sfPW6+Hau42c1joCjMPkNwk6

Score
10/10
gozibankerisfbtrojanupx

Malware Config

Extracted

Family

gozi

Targets

    • Target

      fd6a2837f471b90aebdff7d493ce519a_JaffaCakes118

    • Size

      2.9MB

    • MD5

      fd6a2837f471b90aebdff7d493ce519a

    • SHA1

      c57e035e23296200f0ae76fc6c8b84c3db37587e

    • SHA256

      655da3e3009d3bbe19fce8d2913f11e8afd61d7b567a01f7421b4253230758a6

    • SHA512

      78af260a558caf77a232546d0e8c8af73d948c586ed1e09454ae244c087a86cd48a7bba9087224206ad45601a8fccdb05850ac38d1b04b185acedbcdf33b3421

    • SSDEEP

      49152:IS3+/EyBLQB11vkJ///Im+hqDb3Qv6+9Baj8BBT4SfcsUjoh48TyMPkXdwkyZ:9qLa1sfPW6+Hau42c1joCjMPkNwk6

    Score
    10/10
    gozibankerisfbtrojanupx

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks