Overview

overview

10

Static

static

1

9824928fc9...18.exe

windows7-x64

10

9824928fc9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9824928fc96b2142505b0e9366c9e567_JaffaCakes118

  • Size

    250KB

  • Sample

    240605-pha9waga56

  • MD5

    9824928fc96b2142505b0e9366c9e567

  • SHA1

    bc695025c53eb92503db54e499f4d44e02850c65

  • SHA256

    16b5504f55d019f8584d78672fea51b324a9951af34df58933659bc4deab55a1

  • SHA512

    928c7afd7ce6eb62f0de5e4f28803395c0e62acb83d4c1da48e53ef9fe483c14d14603bb22b1d57041d51f5db274e367403d6f1d2a111622d544d887aa54d620

  • SSDEEP

    3072:IFNthWQl/rSJ7lvt9filcZritkrINAEYsm2:IBhWQ/mJLflrOAp2

Score
10/10
gozi92020311bankerrm3trojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    300913

Extracted

Family

gozi

Botnet

92020311

C2

https://appealingedge.xyz

Attributes
  • build

    300913

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • non_target_locale

    RU

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      9824928fc96b2142505b0e9366c9e567_JaffaCakes118

    • Size

      250KB

    • MD5

      9824928fc96b2142505b0e9366c9e567

    • SHA1

      bc695025c53eb92503db54e499f4d44e02850c65

    • SHA256

      16b5504f55d019f8584d78672fea51b324a9951af34df58933659bc4deab55a1

    • SHA512

      928c7afd7ce6eb62f0de5e4f28803395c0e62acb83d4c1da48e53ef9fe483c14d14603bb22b1d57041d51f5db274e367403d6f1d2a111622d544d887aa54d620

    • SSDEEP

      3072:IFNthWQl/rSJ7lvt9filcZritkrINAEYsm2:IBhWQ/mJLflrOAp2

    Score
    10/10
    gozi92020311bankerrm3trojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks