Overview

overview

10

Static

static

3

4f9fc7ffc4...18.exe

windows7-x64

10

4f9fc7ffc4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f9fc7ffc48e4051b8eb52a5f113ba1c_JaffaCakes118

  • Size

    571KB

  • Sample

    240517-mxkqraed4v

  • MD5

    4f9fc7ffc48e4051b8eb52a5f113ba1c

  • SHA1

    082179f858d5de656280d0347684af0f97bd4062

  • SHA256

    6bb7ad593e18dc28620551328658c9d986ac7afe44aaf5cacb140fa6fe686bca

  • SHA512

    9d09c11642ac53ef4bbf66691b37f94a557e2e0018b4c2a8f0e1a98aae377fa6b0b2e1133d1033d8a63d655e5a0d3af19ced4416b31ea8ca14cabaa65c990f97

  • SSDEEP

    12288:CT7JDjN1yH6HE3P1xU5eJX/5rlprfxRVj7ELrUMI6L:CTu6qxUU9FhWUMd

Score
10/10
gozi3381bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214082

Extracted

Family

gozi

Botnet

3381

C2

microsoft.com

update.microsoft.com

avast.com

f4859della.info

z89p68modesta.top

g54fz534ci.xyz
Attributes
  • build

    214082

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      4f9fc7ffc48e4051b8eb52a5f113ba1c_JaffaCakes118

    • Size

      571KB

    • MD5

      4f9fc7ffc48e4051b8eb52a5f113ba1c

    • SHA1

      082179f858d5de656280d0347684af0f97bd4062

    • SHA256

      6bb7ad593e18dc28620551328658c9d986ac7afe44aaf5cacb140fa6fe686bca

    • SHA512

      9d09c11642ac53ef4bbf66691b37f94a557e2e0018b4c2a8f0e1a98aae377fa6b0b2e1133d1033d8a63d655e5a0d3af19ced4416b31ea8ca14cabaa65c990f97

    • SSDEEP

      12288:CT7JDjN1yH6HE3P1xU5eJX/5rlprfxRVj7ELrUMI6L:CTu6qxUU9FhWUMd

    Score
    10/10
    gozibankerisfbtrojan3381

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks