Overview

overview

10

Static

static

3

0e01542bdd...18.exe

windows7-x64

10

0e01542bdd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e01542bdd676c53497d649d58eba864_JaffaCakes118

  • Size

    203KB

  • Sample

    240502-kfyj6sfd33

  • MD5

    0e01542bdd676c53497d649d58eba864

  • SHA1

    881d30e8438acf6ab1ddb9a4991472ee670e3092

  • SHA256

    28f51fa6f903768c8b9a8e65c38b7da1ce3cfbb1d431824fb3b07435062497e9

  • SHA512

    54df76e53740c4ee52013068adb831925fc7e7caf37db54ea9b39db708d9baa2a35dd2471ed6b32d8eeb00c6715f4cca1c6a9a892c476fd7f5f5628d35cd1b2f

  • SSDEEP

    3072:9oji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9idp4uPZzGonqXGXh0bluBc4GZ5

Score
10/10
gozi3162bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215165

Extracted

Family

gozi

Botnet

3162

C2

menehleibe.com

liemuteste.com

thulligend.com
Attributes
  • build

    215165

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      0e01542bdd676c53497d649d58eba864_JaffaCakes118

    • Size

      203KB

    • MD5

      0e01542bdd676c53497d649d58eba864

    • SHA1

      881d30e8438acf6ab1ddb9a4991472ee670e3092

    • SHA256

      28f51fa6f903768c8b9a8e65c38b7da1ce3cfbb1d431824fb3b07435062497e9

    • SHA512

      54df76e53740c4ee52013068adb831925fc7e7caf37db54ea9b39db708d9baa2a35dd2471ed6b32d8eeb00c6715f4cca1c6a9a892c476fd7f5f5628d35cd1b2f

    • SSDEEP

      3072:9oji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9idp4uPZzGonqXGXh0bluBc4GZ5

    Score
    10/10
    gozi3162bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks