Overview

overview

10

Static

static

3

25e1790f24...18.exe

windows7-x64

10

25e1790f24...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    25e1790f24b921852ef0fdf5f3a15bbc_JaffaCakes118

  • Size

    215KB

  • Sample

    240508-vs1v6shb33

  • MD5

    25e1790f24b921852ef0fdf5f3a15bbc

  • SHA1

    941f8af821f4188aef4d2d2adccc59f1d5c0655b

  • SHA256

    753a83f1043809098d08e76e49a497ad0e79f571c2d9988e9f059183eac1ba4d

  • SHA512

    9d6caaaa92aa7f2870294bb8f4a97e27d6b09ee264521d354bf5fe39d56815575f14dd25845e2b2ce2d759ae5d4c484e14c1df3705d05f57daa4344475c30a48

  • SSDEEP

    3072:Rb9pXDyUKdySqVgQZt8OdcjFfSvbke/0t4mwqWB55syoNdL0H2L6BWnqR+yV:BHXDy1qVvZnOe/HEyoGWGd

Score
10/10
gozi3153bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215165

Extracted

Family

gozi

Botnet

3153

C2

biesbetiop.com

kircherche.com

toforemedi.com
Attributes
  • build

    215165

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      25e1790f24b921852ef0fdf5f3a15bbc_JaffaCakes118

    • Size

      215KB

    • MD5

      25e1790f24b921852ef0fdf5f3a15bbc

    • SHA1

      941f8af821f4188aef4d2d2adccc59f1d5c0655b

    • SHA256

      753a83f1043809098d08e76e49a497ad0e79f571c2d9988e9f059183eac1ba4d

    • SHA512

      9d6caaaa92aa7f2870294bb8f4a97e27d6b09ee264521d354bf5fe39d56815575f14dd25845e2b2ce2d759ae5d4c484e14c1df3705d05f57daa4344475c30a48

    • SSDEEP

      3072:Rb9pXDyUKdySqVgQZt8OdcjFfSvbke/0t4mwqWB55syoNdL0H2L6BWnqR+yV:BHXDy1qVvZnOe/HEyoGWGd

    Score
    10/10
    gozi3153bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks