Overview

overview

10

Static

static

3

06772ffd85...18.exe

windows7-x64

10

06772ffd85...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06772ffd858cbcae85a391def1182db6_JaffaCakes118

  • Size

    547KB

  • Sample

    240429-bbrrdsdg9s

  • MD5

    06772ffd858cbcae85a391def1182db6

  • SHA1

    f38cc5e5a9d855b3060227c05f34aa20e788765d

  • SHA256

    ed2a2d9210f45a20ebf709dcea6b0bd68da6c1e5ce9d66defc631b27ad48ae24

  • SHA512

    33e771844a22f559e11331278bfd0d1da5305cae534b2e426658c048a98e74a054f113640221624db3d209f72718e09a6c44acc46fd6edc23b3735b64672e5b5

  • SSDEEP

    6144:uVJt7IsATy65KJZnF/gYdpOLwCF/lauaS7tsPUF18avHUwAIgJ+ke:uFTM5utF/tdpmp7tKO6asJIgJt

Score
10/10
gozi3187bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214062

Extracted

Family

gozi

Botnet

3187

C2

qrodericky94.company

g77yelsao.company

tromainevirginia.email
Attributes
  • build

    214062

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      06772ffd858cbcae85a391def1182db6_JaffaCakes118

    • Size

      547KB

    • MD5

      06772ffd858cbcae85a391def1182db6

    • SHA1

      f38cc5e5a9d855b3060227c05f34aa20e788765d

    • SHA256

      ed2a2d9210f45a20ebf709dcea6b0bd68da6c1e5ce9d66defc631b27ad48ae24

    • SHA512

      33e771844a22f559e11331278bfd0d1da5305cae534b2e426658c048a98e74a054f113640221624db3d209f72718e09a6c44acc46fd6edc23b3735b64672e5b5

    • SSDEEP

      6144:uVJt7IsATy65KJZnF/gYdpOLwCF/lauaS7tsPUF18avHUwAIgJ+ke:uFTM5utF/tdpmp7tKO6asJIgJt

    Score
    10/10
    gozi3187bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks