Overview

overview

10

Static

static

3

41d8305ade...18.exe

windows7-x64

10

41d8305ade...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41d8305ade7cd6e2e5e3f89591e96ccd_JaffaCakes118

  • Size

    215KB

  • Sample

    240514-rxshtaba8v

  • MD5

    41d8305ade7cd6e2e5e3f89591e96ccd

  • SHA1

    fa9dc3c0e3adc9b336c68b37c4d50c26e81dfdef

  • SHA256

    c2747a06ccc6983637c8375af1cfe44c05d1197687c9503b2df7cb73f08b1fa5

  • SHA512

    174148de00192521f17c025a7f233c9aa93d7c7f607900915513a8c202d1f05a5e7cccdba26e7af68b89bab54294be9f3728844cb6787331c8209110fdc6d68c

  • SSDEEP

    6144:yebrcHVhZa18z0VbpKWiVanGjozo7vK0C:yarc1TafbpKWsanIozo7vK

Score
10/10
gozi3401bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214082

Extracted

Family

gozi

Botnet

3401

C2

microsoft.com

update.microsoft.com

avast.com

tm90daron.club

jamericohermann.com

b9437ariane.com
Attributes
  • build

    214082

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      41d8305ade7cd6e2e5e3f89591e96ccd_JaffaCakes118

    • Size

      215KB

    • MD5

      41d8305ade7cd6e2e5e3f89591e96ccd

    • SHA1

      fa9dc3c0e3adc9b336c68b37c4d50c26e81dfdef

    • SHA256

      c2747a06ccc6983637c8375af1cfe44c05d1197687c9503b2df7cb73f08b1fa5

    • SHA512

      174148de00192521f17c025a7f233c9aa93d7c7f607900915513a8c202d1f05a5e7cccdba26e7af68b89bab54294be9f3728844cb6787331c8209110fdc6d68c

    • SSDEEP

      6144:yebrcHVhZa18z0VbpKWiVanGjozo7vK0C:yarc1TafbpKWsanIozo7vK

    Score
    10/10
    gozi3401bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks