Overview

overview

10

Static

static

3

6a3de929f9...18.exe

windows7-x64

10

6a3de929f9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a3de929f98b66f1dd0e8c986c975506_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240523-jm137shh23

  • MD5

    6a3de929f98b66f1dd0e8c986c975506

  • SHA1

    f36591e736c97980790a605d134ed4b9f7f0fd12

  • SHA256

    c2246bff0c1ae5b9e3dcfa9f288520624fd6a7f0c3fbc11c2bbf7afd8915d61c

  • SHA512

    edc63fd8e3c1f5281909ad824d7b7734700ee05f31a533fb9ce6bf8c49c389c6bd4e69129412fab75ca97e2e5c97a74bf591b9f0922b929c5e2a97c9f9c13638

  • SSDEEP

    49152:kB9NjHLDKvHd5GY++tqg2FsYmWVvP+FeBG+VBSaL12xN//Gag8:kBzHLDKV5GCtqgGsYmWVvP+FeA+H0xNn

Score
10/10
gozi3531bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214107

Extracted

Family

gozi

Botnet

3531

C2

gmail.com

google.com

k55gaisi.com

leinwqoa.com

bon11ljgarry.com
Attributes
  • build

    214107

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      6a3de929f98b66f1dd0e8c986c975506_JaffaCakes118

    • Size

      1.6MB

    • MD5

      6a3de929f98b66f1dd0e8c986c975506

    • SHA1

      f36591e736c97980790a605d134ed4b9f7f0fd12

    • SHA256

      c2246bff0c1ae5b9e3dcfa9f288520624fd6a7f0c3fbc11c2bbf7afd8915d61c

    • SHA512

      edc63fd8e3c1f5281909ad824d7b7734700ee05f31a533fb9ce6bf8c49c389c6bd4e69129412fab75ca97e2e5c97a74bf591b9f0922b929c5e2a97c9f9c13638

    • SSDEEP

      49152:kB9NjHLDKvHd5GY++tqg2FsYmWVvP+FeBG+VBSaL12xN//Gag8:kBzHLDKV5GCtqgGsYmWVvP+FeA+H0xNn

    Score
    10/10
    gozibankerisfbtrojan3531

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks