Overview

overview

10

Static

static

3

2d87019dc9...18.exe

windows7-x64

10

2d87019dc9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d87019dc99ab08a8502e1fdebe177be_JaffaCakes118

  • Size

    243KB

  • Sample

    240510-fxxlzsgd89

  • MD5

    2d87019dc99ab08a8502e1fdebe177be

  • SHA1

    e51aaaccee9f82db145756bd9a58889b686f3450

  • SHA256

    9d2aa360c9712e2d7b71143a09f7bb219bd82dedfb7ab8987c43c1d8cdc3c64b

  • SHA512

    5d37598ab76da92fbe2b4d6458e8c3b66dd66ab9d0bc0de1ce767b4e66f636394e4025a9e09b39cd6c92b87cbc1d911bda731822515d599ac150022fee74bb8a

  • SSDEEP

    6144:EDLKwp//Rucg4LF3LPqYRQfoF23dnd/H:ILK5e1qBfoFgdn

Score
10/10
gozi3515bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214098

Extracted

Family

gozi

Botnet

3515

C2

google.com

gmail.com

v61nkkybd.com

dee12yadira43.com

ffhyyo51y.com
Attributes
  • build

    214098

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      2d87019dc99ab08a8502e1fdebe177be_JaffaCakes118

    • Size

      243KB

    • MD5

      2d87019dc99ab08a8502e1fdebe177be

    • SHA1

      e51aaaccee9f82db145756bd9a58889b686f3450

    • SHA256

      9d2aa360c9712e2d7b71143a09f7bb219bd82dedfb7ab8987c43c1d8cdc3c64b

    • SHA512

      5d37598ab76da92fbe2b4d6458e8c3b66dd66ab9d0bc0de1ce767b4e66f636394e4025a9e09b39cd6c92b87cbc1d911bda731822515d599ac150022fee74bb8a

    • SSDEEP

      6144:EDLKwp//Rucg4LF3LPqYRQfoF23dnd/H:ILK5e1qBfoFgdn

    Score
    10/10
    gozi3515bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks