Overview

overview

10

Static

static

3

24fa3919d2...18.exe

windows7-x64

10

24fa3919d2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24fa3919d2855b929e82604ceef5b533_JaffaCakes118

  • Size

    218KB

  • Sample

    240508-qddd4seb2s

  • MD5

    24fa3919d2855b929e82604ceef5b533

  • SHA1

    24792cab6e618b6791cdbe3b9a70c8f37eb03eee

  • SHA256

    7be3bb1bb535953fccb12a64a5cec7be39a2760614b64b59e3130ba906b5b937

  • SHA512

    4d273785f4f6b9066f0b04f7678ad018b378f1b161d005d74f01dca9af3ba12b7ecb610d72d7066a9630c7bd91ac2374f43f7ddaf8898340af7503ce04e02c35

  • SSDEEP

    1536:/P6W/ZEooviattD2XWTuIgnu5IkbgIhMf4s23CUCU1BlhEshLug5gOqq3gLC96lW:/J5tIDzgCE4DHfrEmLL5gOFanlY40U

Score
10/10
gozi4499bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215165

Extracted

Family

gozi

Botnet

4499

C2

http://list.aquelequegostadecorrer.com

Attributes
  • build

    215165

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      24fa3919d2855b929e82604ceef5b533_JaffaCakes118

    • Size

      218KB

    • MD5

      24fa3919d2855b929e82604ceef5b533

    • SHA1

      24792cab6e618b6791cdbe3b9a70c8f37eb03eee

    • SHA256

      7be3bb1bb535953fccb12a64a5cec7be39a2760614b64b59e3130ba906b5b937

    • SHA512

      4d273785f4f6b9066f0b04f7678ad018b378f1b161d005d74f01dca9af3ba12b7ecb610d72d7066a9630c7bd91ac2374f43f7ddaf8898340af7503ce04e02c35

    • SSDEEP

      1536:/P6W/ZEooviattD2XWTuIgnu5IkbgIhMf4s23CUCU1BlhEshLug5gOqq3gLC96lW:/J5tIDzgCE4DHfrEmLL5gOFanlY40U

    Score
    10/10
    gozi4499bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks