Overview

overview

10

Static

static

3

752b875603...18.exe

windows7-x64

10

752b875603...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    752b8756034e2479be4fea4b6890f311_JaffaCakes118

  • Size

    270KB

  • Sample

    240526-mdy42aeh6y

  • MD5

    752b8756034e2479be4fea4b6890f311

  • SHA1

    1add52ff40c09eacc1f2d85c7b4dbc1e837c2564

  • SHA256

    bc4b22d7ff438dc678dbe9b3f0b104147f478167dc9cc0c5ce910fafffe971d9

  • SHA512

    59c21fb2e0808cab47442965c35dda3533d3675fb9ab3522c4dfb90f84436a7bb884a39e2cbb343d084c92a9cc8ca9080fb8f13d308d323c6bfcd50fcc714fc9

  • SSDEEP

    6144:4DGAMQsMMHfkHFH/mW+ftthwYuEfmah3MaakMd:sGAMQZM/iqtjwYuEf9MaYd

Score
10/10
gozi3139bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215165

Extracted

Family

gozi

Botnet

3139

C2

mochigokat.com

osoroshisa.com

udasarekus.com
Attributes
  • build

    215165

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      752b8756034e2479be4fea4b6890f311_JaffaCakes118

    • Size

      270KB

    • MD5

      752b8756034e2479be4fea4b6890f311

    • SHA1

      1add52ff40c09eacc1f2d85c7b4dbc1e837c2564

    • SHA256

      bc4b22d7ff438dc678dbe9b3f0b104147f478167dc9cc0c5ce910fafffe971d9

    • SHA512

      59c21fb2e0808cab47442965c35dda3533d3675fb9ab3522c4dfb90f84436a7bb884a39e2cbb343d084c92a9cc8ca9080fb8f13d308d323c6bfcd50fcc714fc9

    • SSDEEP

      6144:4DGAMQsMMHfkHFH/mW+ftthwYuEfmah3MaakMd:sGAMQZM/iqtjwYuEf9MaYd

    Score
    10/10
    gozi3139bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks