gozi | 7e21a9998ae9f039f6d90f428f17bdcbe2863c8dd91585e41b13d399cc142fe2 | Triage

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 18:28

Sharing

Report Analysis Logs

General

Target

562ce419af442760ddee7fec62186f62_JaffaCakes118.exe
Size

371KB
MD5

562ce419af442760ddee7fec62186f62
SHA1

d71735ac11a2d960e45f404b09a1fb5cad0016a4
SHA256

7e21a9998ae9f039f6d90f428f17bdcbe2863c8dd91585e41b13d399cc142fe2
SHA512

704e76ebc044668d6a687b29fc67a28bb9f4723ef0d2cd44eb61bdc878f33739d951808b778de592225092387da766cf917ed20e579bc27558edabff060c854e
SSDEEP

6144:G3MsyAHzIpNO9TgwOtYlNydEssQt+nQ9BrLmxp7DU:G3MXAec0VtyNwEfzn0qpU

Score

10^/10

gozi banker isfb trojan

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

C:\Users\Admin\AppData\Local\Temp\562ce419af442760ddee7fec62186f62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\562ce419af442760ddee7fec62186f62_JaffaCakes118.exe"
1⤵
PID:2256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2256-1-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2256-2-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2256-3-0x00000000025F0000-0x0000000002634000-memory.dmp

Filesize
272KB

Download
memory/2256-10-0x00000000025F0000-0x0000000002634000-memory.dmp

Filesize
272KB

Download
memory/2256-11-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2256-12-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download