gozi | 7fef19599fb5cbaf9f6ae51e480035b7318585822ea405e7d9a1547edcfbf32a | Triage

Submit
Reports

Overview

overview

Static

static

3

4c8b4c34d5...18.exe

windows7-x64

4c8b4c34d5...18.exe

windows10-2004-x64

Sharing

General

Target

4c8b4c34d5035beca0d8681e9829d573_JaffaCakes118
Size

203KB
Sample

240516-xg3xhaah7t
MD5

4c8b4c34d5035beca0d8681e9829d573
SHA1

c6e923ab7b8ce7c58bf3b7fd4fa57fb2730811b8
SHA256

7fef19599fb5cbaf9f6ae51e480035b7318585822ea405e7d9a1547edcfbf32a
SHA512

61ba7ae7f3f5c9f1bf8723b308b8ff70f9fba01dcc0a078b80b32abb1912f1b0add6e8a2a87e5df68ccfe770569076aac12794dd9330f0558942d2990fc86de8
SSDEEP

3072:9xji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9ldp4uPZzGonqXGXh0bluBc4GZ5

Score

10^/10

gozi 3162 banker isfb trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4c8b4c34d5035beca0d8681e9829d573_JaffaCakes118.exe

Resource

win7-20240221-en

gozi 3162 banker isfb trojan

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

4c8b4c34d5035beca0d8681e9829d573_JaffaCakes118.exe

Resource

win10v2004-20240508-en

gozi 3162 banker isfb trojan

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3162

C2

menehleibe.com

liemuteste.com

thulligend.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  4c8b4c34d5035beca0d8681e9829d573_JaffaCakes118
- Size
  
  203KB
- MD5
  
  4c8b4c34d5035beca0d8681e9829d573
- SHA1
  
  c6e923ab7b8ce7c58bf3b7fd4fa57fb2730811b8
- SHA256
  
  7fef19599fb5cbaf9f6ae51e480035b7318585822ea405e7d9a1547edcfbf32a
- SHA512
  
  61ba7ae7f3f5c9f1bf8723b308b8ff70f9fba01dcc0a078b80b32abb1912f1b0add6e8a2a87e5df68ccfe770569076aac12794dd9330f0558942d2990fc86de8
- SSDEEP
  
  3072:9xji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9ldp4uPZzGonqXGXh0bluBc4GZ5
Score

10^/10

gozi 3162 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

gozi3162bankerisfbtrojan

behavioral2

gozi3162bankerisfbtrojan

© 2018-2024

Terms | Privacy