Overview

overview

10

Static

static

3

57de86fea2...18.exe

windows7-x64

10

57de86fea2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57de86fea26df1bbf0a2311318ef9688_JaffaCakes118

  • Size

    3.7MB

  • Sample

    240519-bsnfasba6s

  • MD5

    57de86fea26df1bbf0a2311318ef9688

  • SHA1

    27221316b2b919401a3027610ade1025b0dba703

  • SHA256

    5e98901654f1da82cbe17081e74f72085d0a136b061fa76d6a4d0bc289dce8db

  • SHA512

    12eeb2d309df47821e93498b20e83585f71bbba3bf540055dc12767186ab1e3823973806bf63e40a05520ba74f2e34d82a879740565c3055442b7cf0ebe59aa4

  • SSDEEP

    49152:ycEeyG//rasoeodqlOdN8n+uwyme4oAOiWEvujAW61QXoTvI1k:pEc7oeoMliyb7MEAzQ4T

Score
10/10
gozi3523bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214098

Extracted

Family

gozi

Botnet

3523

C2

fortinet.com

symantec.com

z39bldfq.com

r79xhiram81ue.com

mlqlqewh.com
Attributes
  • build

    214098

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      57de86fea26df1bbf0a2311318ef9688_JaffaCakes118

    • Size

      3.7MB

    • MD5

      57de86fea26df1bbf0a2311318ef9688

    • SHA1

      27221316b2b919401a3027610ade1025b0dba703

    • SHA256

      5e98901654f1da82cbe17081e74f72085d0a136b061fa76d6a4d0bc289dce8db

    • SHA512

      12eeb2d309df47821e93498b20e83585f71bbba3bf540055dc12767186ab1e3823973806bf63e40a05520ba74f2e34d82a879740565c3055442b7cf0ebe59aa4

    • SSDEEP

      49152:ycEeyG//rasoeodqlOdN8n+uwyme4oAOiWEvujAW61QXoTvI1k:pEc7oeoMliyb7MEAzQ4T

    Score
    10/10
    gozi3523bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks