Overview

overview

10

Static

static

1

1a6c3538fd...18.exe

windows7-x64

10

1a6c3538fd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a6c3538fdc7f47444941df8698b068e_JaffaCakes118

  • Size

    972KB

  • Sample

    240506-ddqyzseg3t

  • MD5

    1a6c3538fdc7f47444941df8698b068e

  • SHA1

    f0a71eec25204c81e4f4fb7a91110a8fd3bedeab

  • SHA256

    30bb7b0a988a5d25a8a9da3f01634e49792acd8f97d05fb162971b3307654056

  • SHA512

    dd8268951b3de43fd32f85713d18a264e08c68c44ad31741f0067b8c8cfed4d981889151b1d34a407bbbc1f12c56db6d48e59ce12ebdc2209f078ecd167ce636

  • SSDEEP

    6144:AqqZdrSLcCjbcU5h7bALnlpSIu5U7/AW+NtBgn3CqzwdGUm66e5z/+QrcpTOV8Ns:SdrIwU5hT

Score
10/10
gozi201909031bankerrm3trojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    300768

Extracted

Family

gozi

Botnet

201909031

C2

https://ciaraburkett.xyz

Attributes
  • build

    300768

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      1a6c3538fdc7f47444941df8698b068e_JaffaCakes118

    • Size

      972KB

    • MD5

      1a6c3538fdc7f47444941df8698b068e

    • SHA1

      f0a71eec25204c81e4f4fb7a91110a8fd3bedeab

    • SHA256

      30bb7b0a988a5d25a8a9da3f01634e49792acd8f97d05fb162971b3307654056

    • SHA512

      dd8268951b3de43fd32f85713d18a264e08c68c44ad31741f0067b8c8cfed4d981889151b1d34a407bbbc1f12c56db6d48e59ce12ebdc2209f078ecd167ce636

    • SSDEEP

      6144:AqqZdrSLcCjbcU5h7bALnlpSIu5U7/AW+NtBgn3CqzwdGUm66e5z/+QrcpTOV8Ns:SdrIwU5hT

    Score
    10/10
    gozi201909031bankerrm3trojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks