Overview

overview

10

Static

static

3

6da22b8fe3...18.exe

windows7-x64

10

6da22b8fe3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6da22b8fe318fb2ae4ffa3441775ad02_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240524-hgr3nsgg22

  • MD5

    6da22b8fe318fb2ae4ffa3441775ad02

  • SHA1

    1c04233c22c101dad738305570f20c3cc2006a47

  • SHA256

    c05f4aeb60fb3c7f2f91d00fc6e6065e1da72c3c14a27ed5f6208251512f7aa3

  • SHA512

    c6c059a3bdbd72f29d5ca4336ab883f136ecb644d027b174559cf91594417dd465f02cd614129940bd17e9f5025f586409a7a61a15ebd67a4921cd30da8b77fa

  • SSDEEP

    49152:4SuE3ftrqPKIO23Hlin6COYolnyJ2WR6wOHste0uIlCj790Lhf4xC0FyQ4L6nd:3L39qPKIOson6Cslny8WR6wOHstehsC7

Score
10/10
gozi3184bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214062

Extracted

Family

gozi

Botnet

3184

C2

qfelicialew.city

mzg4958lc.com

gxuxwnszau.band
Attributes
  • build

    214062

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      6da22b8fe318fb2ae4ffa3441775ad02_JaffaCakes118

    • Size

      1.8MB

    • MD5

      6da22b8fe318fb2ae4ffa3441775ad02

    • SHA1

      1c04233c22c101dad738305570f20c3cc2006a47

    • SHA256

      c05f4aeb60fb3c7f2f91d00fc6e6065e1da72c3c14a27ed5f6208251512f7aa3

    • SHA512

      c6c059a3bdbd72f29d5ca4336ab883f136ecb644d027b174559cf91594417dd465f02cd614129940bd17e9f5025f586409a7a61a15ebd67a4921cd30da8b77fa

    • SSDEEP

      49152:4SuE3ftrqPKIO23Hlin6COYolnyJ2WR6wOHste0uIlCj790Lhf4xC0FyQ4L6nd:3L39qPKIOson6Cslny8WR6wOHstehsC7

    Score
    10/10
    gozi3184bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks