Overview

overview

10

Static

static

3

45e6b81fdf...18.exe

windows7-x64

10

45e6b81fdf...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    45e6b81fdfdfaf9a582da71ee8ecc31a_JaffaCakes118

  • Size

    243KB

  • Sample

    240515-na2anaee8s

  • MD5

    45e6b81fdfdfaf9a582da71ee8ecc31a

  • SHA1

    4cf4ecf9f7ed6c679a56ba60ce2f31a641b7706a

  • SHA256

    7ec041d61421cad2722cc5af36301213f0503a97fdfe44c15d6ab736e019ea0a

  • SHA512

    94f235393a6fb2964e5254f187ce85daa72d2a77585af236e7064a0eb96da7154587a2fd83e53f3d3c5c3de78e3b9e455294304c3f8e4af4ad5eea2d28817ca7

  • SSDEEP

    6144:EDLKwp//Rucg4LF3LPqYRQfoF2Cdnd/H:ILK5e1qBfoFFdn

Score
10/10
gozi3515bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214098

Extracted

Family

gozi

Botnet

3515

C2

google.com

gmail.com

v61nkkybd.com

dee12yadira43.com

ffhyyo51y.com
Attributes
  • build

    214098

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      45e6b81fdfdfaf9a582da71ee8ecc31a_JaffaCakes118

    • Size

      243KB

    • MD5

      45e6b81fdfdfaf9a582da71ee8ecc31a

    • SHA1

      4cf4ecf9f7ed6c679a56ba60ce2f31a641b7706a

    • SHA256

      7ec041d61421cad2722cc5af36301213f0503a97fdfe44c15d6ab736e019ea0a

    • SHA512

      94f235393a6fb2964e5254f187ce85daa72d2a77585af236e7064a0eb96da7154587a2fd83e53f3d3c5c3de78e3b9e455294304c3f8e4af4ad5eea2d28817ca7

    • SSDEEP

      6144:EDLKwp//Rucg4LF3LPqYRQfoF2Cdnd/H:ILK5e1qBfoFFdn

    Score
    10/10
    gozi3515bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks