gozi | 91c2c546949c57936f7b4f668d0fea27cb14813a2fbd6b8df4a028f389ea20e3 | Triage

Sharing

General

Target

8a68dd8eb11a12832249d08e81a7a3ab_JaffaCakes118
Size

203KB
Sample

240601-n5dg3sbg41
MD5

8a68dd8eb11a12832249d08e81a7a3ab
SHA1

9e9b06d53307c11396d153eae326cd57712ec837
SHA256

91c2c546949c57936f7b4f668d0fea27cb14813a2fbd6b8df4a028f389ea20e3
SHA512

941161b79299d0146e92d8bd4c0a99f993262f9a931e7844a40110be0cd6d80067f94908305f00bdf52409693e445ee48ec85f7745d532c1c17c925b179e6117
SSDEEP

3072:9Sji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9cdp4uPZzGonqXGXh0bluBc4GZ5

Score

10^/10

gozi 3162 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3162

C2

menehleibe.com

liemuteste.com

thulligend.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  8a68dd8eb11a12832249d08e81a7a3ab_JaffaCakes118
- Size
  
  203KB
- MD5
  
  8a68dd8eb11a12832249d08e81a7a3ab
- SHA1
  
  9e9b06d53307c11396d153eae326cd57712ec837
- SHA256
  
  91c2c546949c57936f7b4f668d0fea27cb14813a2fbd6b8df4a028f389ea20e3
- SHA512
  
  941161b79299d0146e92d8bd4c0a99f993262f9a931e7844a40110be0cd6d80067f94908305f00bdf52409693e445ee48ec85f7745d532c1c17c925b179e6117
- SSDEEP
  
  3072:9Sji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9cdp4uPZzGonqXGXh0bluBc4GZ5
Score

10^/10

gozi 3162 banker isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

gozi3162bankerisfbtrojan

behavioral2

gozi3162bankerisfbtrojan