Overview

overview

10

Static

static

3

66a8ee4726...18.exe

windows7-x64

10

66a8ee4726...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    66a8ee472600d007772cc17042a17c0b_JaffaCakes118

  • Size

    354KB

  • Sample

    240522-kjbjtahg6w

  • MD5

    66a8ee472600d007772cc17042a17c0b

  • SHA1

    9187986d0df9f19171fbd35bf76faaf3d11b3d3b

  • SHA256

    a6095bf8a00bb9896d4a598834612ab89ae726230e73a1e95133701901745c57

  • SHA512

    10ebf706cd29737381c437e20e2c0edc89dcba7af1d35e2a4166ce0594b27932312535ee890433cfda693d17193c2b238348a689d3e4f72f5e64f8e648a3ac5c

  • SSDEEP

    6144:jyp7pQMOtvhiNyVyZHbzU5/JMi+xLus/AWQB9X:opWhcyIZHnU5RPu4B9X

Score
10/10
gozi3177bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214062

Extracted

Family

gozi

Botnet

3177

C2

wgcjeremy11.band

skelsigabriella.fun

xelectauishanie.email
Attributes
  • build

    214062

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      66a8ee472600d007772cc17042a17c0b_JaffaCakes118

    • Size

      354KB

    • MD5

      66a8ee472600d007772cc17042a17c0b

    • SHA1

      9187986d0df9f19171fbd35bf76faaf3d11b3d3b

    • SHA256

      a6095bf8a00bb9896d4a598834612ab89ae726230e73a1e95133701901745c57

    • SHA512

      10ebf706cd29737381c437e20e2c0edc89dcba7af1d35e2a4166ce0594b27932312535ee890433cfda693d17193c2b238348a689d3e4f72f5e64f8e648a3ac5c

    • SSDEEP

      6144:jyp7pQMOtvhiNyVyZHbzU5/JMi+xLus/AWQB9X:opWhcyIZHnU5RPu4B9X

    Score
    10/10
    gozi3177bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks