Overview

overview

10

Static

static

3

2bc8cee04d...18.exe

windows7-x64

10

2bc8cee04d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2bc8cee04d1268e58906da502cae5fc0_JaffaCakes118

  • Size

    215KB

  • Sample

    240509-1a7hwsfd4y

  • MD5

    2bc8cee04d1268e58906da502cae5fc0

  • SHA1

    c3f9dcb9a71449913a1dfefe8f45eca41d2c1186

  • SHA256

    3665125d615fbe020d0e2eb885aea3aefaa032ed78f2b1427ff1163ef1a44780

  • SHA512

    ee198df0bbeb54d0367ee770325925765209c11aa6d7ecaca9a1b0632c0c8110b67763ff9390c43373389abbc396f15ecd3620db748863a5d8695574840f126e

  • SSDEEP

    3072:Rb9pXDyUKdySqVgQZt8OdcjFfSvbke/0t4mwqWB55syoNdL0s2L6BWnqR+yV:BHXDy1qVvZnOe/HEyoPWGd

Score
10/10
gozi3153bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215165

Extracted

Family

gozi

Botnet

3153

C2

biesbetiop.com

kircherche.com

toforemedi.com
Attributes
  • build

    215165

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      2bc8cee04d1268e58906da502cae5fc0_JaffaCakes118

    • Size

      215KB

    • MD5

      2bc8cee04d1268e58906da502cae5fc0

    • SHA1

      c3f9dcb9a71449913a1dfefe8f45eca41d2c1186

    • SHA256

      3665125d615fbe020d0e2eb885aea3aefaa032ed78f2b1427ff1163ef1a44780

    • SHA512

      ee198df0bbeb54d0367ee770325925765209c11aa6d7ecaca9a1b0632c0c8110b67763ff9390c43373389abbc396f15ecd3620db748863a5d8695574840f126e

    • SSDEEP

      3072:Rb9pXDyUKdySqVgQZt8OdcjFfSvbke/0t4mwqWB55syoNdL0s2L6BWnqR+yV:BHXDy1qVvZnOe/HEyoPWGd

    Score
    10/10
    gozi3153bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks