Overview

overview

10

Static

static

3

65a5bafeff...18.exe

windows7-x64

10

65a5bafeff...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65a5bafeff81faaf8a46e737857458fc_JaffaCakes118

  • Size

    203KB

  • Sample

    240522-cms92aha58

  • MD5

    65a5bafeff81faaf8a46e737857458fc

  • SHA1

    6a683a0f8b93fafe295e9a29153e07e80bd0c5e4

  • SHA256

    79fc6e50e92e8eef73f0740a64e92798adaee64dd9b4b1b11601c699c7adca1c

  • SHA512

    939d15c785720020a0b9501c7f1c76c15d42d94faf1a1c98422ffd7feda03ed0ffe67fc59ed8e07072fa1af5fe52c921c2f9a987bada6c4bc6cc6f0cbdf67a94

  • SSDEEP

    3072:9wji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9Kdp4uPZzGonqXGXh0bluBc4GZ5

Score
10/10
gozi3162bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215165

Extracted

Family

gozi

Botnet

3162

C2

menehleibe.com

liemuteste.com

thulligend.com
Attributes
  • build

    215165

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      65a5bafeff81faaf8a46e737857458fc_JaffaCakes118

    • Size

      203KB

    • MD5

      65a5bafeff81faaf8a46e737857458fc

    • SHA1

      6a683a0f8b93fafe295e9a29153e07e80bd0c5e4

    • SHA256

      79fc6e50e92e8eef73f0740a64e92798adaee64dd9b4b1b11601c699c7adca1c

    • SHA512

      939d15c785720020a0b9501c7f1c76c15d42d94faf1a1c98422ffd7feda03ed0ffe67fc59ed8e07072fa1af5fe52c921c2f9a987bada6c4bc6cc6f0cbdf67a94

    • SSDEEP

      3072:9wji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9Kdp4uPZzGonqXGXh0bluBc4GZ5

    Score
    10/10
    gozi3162bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks