Resubmissions

30-05-2024 21:31

240530-1c1hcsab8v 10

30-05-2024 21:21

240530-z7cjcaaa5x 10

General

  • Target

    easfawefawfas.exe

  • Size

    12KB

  • Sample

    240530-1c1hcsab8v

  • MD5

    2813b6e3ed4bd6b14c53e3dffcdff21d

  • SHA1

    5ac7c7a3dadde70f94810c608a2eb275f14b7bde

  • SHA256

    866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a

  • SHA512

    ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24

  • SSDEEP

    192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo

Malware Config

Extracted

Family

gozi

Targets

    • Target

      easfawefawfas.exe

    • Size

      12KB

    • MD5

      2813b6e3ed4bd6b14c53e3dffcdff21d

    • SHA1

      5ac7c7a3dadde70f94810c608a2eb275f14b7bde

    • SHA256

      866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a

    • SHA512

      ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24

    • SSDEEP

      192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks