gozi | d9bd9e8b091f780a96f56d84c4727b89a2e2413007f6337aed04a9970081db87

Analysis

max time kernel
141s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 17:34

Target

95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe
Size

733KB
MD5

95b3df629486f52dc64c2c38ba49b9f6
SHA1

e4ca6bf835d00975cc2b41fc45c7d7a473b7eb8c
SHA256

d9bd9e8b091f780a96f56d84c4727b89a2e2413007f6337aed04a9970081db87
SHA512

aafcfa574b6dc9844a7c50515d5a1d5d89ad710009438314c1cf2b6d920b63c95f632b626109f2c3e1d0ace34d578e271b6cea11f479a264e0c9353e8801c1c2
SSDEEP

12288:n6TNQkTwso08kB9o/MJmjKiqHIyKnFioFheYexAX7s6tWeRY45CLEJCenEPReTS/:n6yqa61Jm+HnKnQEjKAJtWf45kkCeEPT

Score

10^/10

Family

gozi

Attributes

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2888-0-0x0000000000400000-0x00000000005B1000-memory.dmp	upx
behavioral1/memory/2888-1-0x0000000000400000-0x00000000005B1000-memory.dmp	upx
behavioral1/memory/2888-3-0x0000000000400000-0x00000000005B1000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe

pid process

2888 95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe

pid	process
2888	95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2888

memory/2888-0-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/2888-1-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/2888-3-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/2888-4-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download
memory/2888-5-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2888-6-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2888-7-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2888-8-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2888-10-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2888-9-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download
memory/2888-11-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/2888-12-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/2888-14-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download