Overview

overview

10

Static

static

3

4c640f8262...18.exe

windows7-x64

10

4c640f8262...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c640f826205255714a7a5ad0eac1758_JaffaCakes118

  • Size

    231KB

  • Sample

    240516-wr9x5ahc76

  • MD5

    4c640f826205255714a7a5ad0eac1758

  • SHA1

    d67e245559f2bfdf412b8a2bbd50cd9895297265

  • SHA256

    7c16f59fc9c7134435996ebd1658d9e11f7951c5245ee6dcc176794fe8f94e58

  • SHA512

    cbf629ca740a4f56a81625e676666ce9434b7daebb3cb43c549e021442e2a4dddef57cea0fa8084ee87e3cccd6ece50756b268bf93b403493104d2c912d8572a

  • SSDEEP

    6144:RGcba3NwVhrBWUyAhCFvIA+Ed9h1RLMxn6Igquv0:RG4a9wTrB8OCJIrU9h1RLMxnVm0

Score
10/10
gozi3485bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214085

Extracted

Family

gozi

Botnet

3485

C2

google.com

gmail.com

s39aihzlia.com

hqrya64peyton.com

l58er.com
Attributes
  • build

    214085

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      4c640f826205255714a7a5ad0eac1758_JaffaCakes118

    • Size

      231KB

    • MD5

      4c640f826205255714a7a5ad0eac1758

    • SHA1

      d67e245559f2bfdf412b8a2bbd50cd9895297265

    • SHA256

      7c16f59fc9c7134435996ebd1658d9e11f7951c5245ee6dcc176794fe8f94e58

    • SHA512

      cbf629ca740a4f56a81625e676666ce9434b7daebb3cb43c549e021442e2a4dddef57cea0fa8084ee87e3cccd6ece50756b268bf93b403493104d2c912d8572a

    • SSDEEP

      6144:RGcba3NwVhrBWUyAhCFvIA+Ed9h1RLMxn6Igquv0:RG4a9wTrB8OCJIrU9h1RLMxnVm0

    Score
    10/10
    gozi3485bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks