Overview

overview

10

Static

static

3

2e97e1d360...18.exe

windows7-x64

10

2e97e1d360...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e97e1d360ffc5a0eb053be1405a4ae5_JaffaCakes118

  • Size

    295KB

  • Sample

    240510-l4fjyabg37

  • MD5

    2e97e1d360ffc5a0eb053be1405a4ae5

  • SHA1

    6a3c7380cb0ad55598e0774e8e865387514aa250

  • SHA256

    7f343116f1e00ec7383946710c46958228207eeada77f28452063cca23b38459

  • SHA512

    05c9124c1f3b664e2bc0b319ca235b236776235d6fcee9c38d22cce8221daf4131c5c7dff8bb6e0e06aac9d27b4e1cc98976dc8f1f4293757efc8b441518d1cf

  • SSDEEP

    6144:pOHufAfX3XBdWbEV2PT7OTtDLG6WKqRMY05TSTDazcydNl/XU:7adWbO2PT7ElLQnRP0BS6

Score
10/10
gozi3337bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Botnet

3337

C2

tericks90.info

hchyna985.top

cannamariecordell.com
Attributes
  • build

    214080

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      2e97e1d360ffc5a0eb053be1405a4ae5_JaffaCakes118

    • Size

      295KB

    • MD5

      2e97e1d360ffc5a0eb053be1405a4ae5

    • SHA1

      6a3c7380cb0ad55598e0774e8e865387514aa250

    • SHA256

      7f343116f1e00ec7383946710c46958228207eeada77f28452063cca23b38459

    • SHA512

      05c9124c1f3b664e2bc0b319ca235b236776235d6fcee9c38d22cce8221daf4131c5c7dff8bb6e0e06aac9d27b4e1cc98976dc8f1f4293757efc8b441518d1cf

    • SSDEEP

      6144:pOHufAfX3XBdWbEV2PT7OTtDLG6WKqRMY05TSTDazcydNl/XU:7adWbO2PT7ElLQnRP0BS6

    Score
    10/10
    gozi3337bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks