Overview

overview

10

Static

static

3

2df2ce148f...18.exe

windows7-x64

10

2df2ce148f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2df2ce148f8cadd995b146606ab02fef_JaffaCakes118

  • Size

    292KB

  • Sample

    240510-hzbteahe4z

  • MD5

    2df2ce148f8cadd995b146606ab02fef

  • SHA1

    bf7344140b981bdc24b8f065fab6dda5c3419147

  • SHA256

    92c29cbb855e9063061dcfc9c205a672c69a405633f0b1781518f3801ca16bb3

  • SHA512

    017ff03b8e83ce0541a6a4e7a0581ee1d660188d3bc2481919d465ecc02036ee384817a9d99dc9139382a239622b8f79e0bd83b8808966c907f074ef02b54ffc

  • SSDEEP

    3072:vKF4z5RUYfiu79iq1YHJiHFvdHw2LGQKihrieFPgjySz9UNottJ5//5lfr2qR:vKF4z5RBfwgtHjGwijyloF72qR

Score
10/10
gozi2000bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Botnet

2000

C2

g2.ex100p.at/webstore

beetfeetlife.bit/webstore

in.termas.at/webstore

ax.ikobut.at/webstore

sm.dvloop.at/webstore

extra.avareg.cn/webstore

api.ex100p.at/webstore

foo.avaregio.at/webstore

op.basedok.at/webstore

f1.cnboal.at/webstore

xxx.lapoder.at/webstore

core.cnboal.at/webstore

pop.muongo.at/webstore
Attributes
  • build

    217061

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • dns_servers

    192.71.245.208

    8.8.8.8

    178.17.170.179

    82.196.9.45

    151.80.222.79

    68.183.70.217

    217.144.135.7

    158.69.160.164

    207.148.83.241

    5.189.170.196

    217.144.132.148

    94.247.43.254

    188.165.200.156

    159.89.249.249

    150.249.149.222

  • exe_type

    loader

  • server_id

    550

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      2df2ce148f8cadd995b146606ab02fef_JaffaCakes118

    • Size

      292KB

    • MD5

      2df2ce148f8cadd995b146606ab02fef

    • SHA1

      bf7344140b981bdc24b8f065fab6dda5c3419147

    • SHA256

      92c29cbb855e9063061dcfc9c205a672c69a405633f0b1781518f3801ca16bb3

    • SHA512

      017ff03b8e83ce0541a6a4e7a0581ee1d660188d3bc2481919d465ecc02036ee384817a9d99dc9139382a239622b8f79e0bd83b8808966c907f074ef02b54ffc

    • SSDEEP

      3072:vKF4z5RUYfiu79iq1YHJiHFvdHw2LGQKihrieFPgjySz9UNottJ5//5lfr2qR:vKF4z5RBfwgtHjGwijyloF72qR

    Score
    10/10
    gozi2000bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks