Overview

overview

10

Static

static

1

738005a89c...18.exe

windows7-x64

10

738005a89c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    738005a89cb9d0914ac2bfa87a2de087_JaffaCakes118

  • Size

    250KB

  • Sample

    240525-2p4afsdh87

  • MD5

    738005a89cb9d0914ac2bfa87a2de087

  • SHA1

    837fa351856ad3d25fdf7d11f438b4ce0575bbf2

  • SHA256

    759776f80fe7a312191286caf08c1e28bfbee5596ce1861607999bb74e450268

  • SHA512

    1b026c46230a443c5b11355ea2d34d9acdecb2a5af628e98bb3b0661da6377a2a341e7666ddb7637b0369c7e56e17ecd250362d39a1ed7ae71b6cf24464997ef

  • SSDEEP

    3072:IFNthWQl/rSJ7lvt9filcZritkrINAEYsm2:IBhWQ/mJLflrOAp2

Score
10/10
gozi92020311bankerrm3trojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    300913

Extracted

Family

gozi

Botnet

92020311

C2

https://appealingedge.xyz

Attributes
  • build

    300913

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • non_target_locale

    RU

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      738005a89cb9d0914ac2bfa87a2de087_JaffaCakes118

    • Size

      250KB

    • MD5

      738005a89cb9d0914ac2bfa87a2de087

    • SHA1

      837fa351856ad3d25fdf7d11f438b4ce0575bbf2

    • SHA256

      759776f80fe7a312191286caf08c1e28bfbee5596ce1861607999bb74e450268

    • SHA512

      1b026c46230a443c5b11355ea2d34d9acdecb2a5af628e98bb3b0661da6377a2a341e7666ddb7637b0369c7e56e17ecd250362d39a1ed7ae71b6cf24464997ef

    • SSDEEP

      3072:IFNthWQl/rSJ7lvt9filcZritkrINAEYsm2:IBhWQ/mJLflrOAp2

    Score
    10/10
    gozi92020311bankerrm3trojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks