Overview

overview

10

Static

static

3

98b18cdd57...18.dll

windows7-x64

10

98b18cdd57...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    98b18cdd57be2e9c4cbe26882dbed293_JaffaCakes118

  • Size

    397KB

  • Sample

    240605-vhe6qadc99

  • MD5

    98b18cdd57be2e9c4cbe26882dbed293

  • SHA1

    1e97f13752d17288b8407d7a9915272c29ba7086

  • SHA256

    b08cef1d01353f794ac2fe61edc97100fbabf82bc9489288c1d8c30fe8221822

  • SHA512

    eaac08996089a7bf37f506ac253b69c7bf3fc3c09811f3814f0743f7598639badd17e3c3c7edf99b4496c096758199f372687acf14af261a997304bedea23012

  • SSDEEP

    6144:fWBPIXnZ8w+PS1s4LsdAj9Js5SwwLBYkgI2i/goeyn07+BKgl:lXZ8wWSi+sVQwot1/Rey07+Egl

Score
10/10
gozi2200bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

2200

C2

api10.laptok.at/api1

Attributes
  • build

    250155

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    730

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      98b18cdd57be2e9c4cbe26882dbed293_JaffaCakes118

    • Size

      397KB

    • MD5

      98b18cdd57be2e9c4cbe26882dbed293

    • SHA1

      1e97f13752d17288b8407d7a9915272c29ba7086

    • SHA256

      b08cef1d01353f794ac2fe61edc97100fbabf82bc9489288c1d8c30fe8221822

    • SHA512

      eaac08996089a7bf37f506ac253b69c7bf3fc3c09811f3814f0743f7598639badd17e3c3c7edf99b4496c096758199f372687acf14af261a997304bedea23012

    • SSDEEP

      6144:fWBPIXnZ8w+PS1s4LsdAj9Js5SwwLBYkgI2i/goeyn07+BKgl:lXZ8wWSi+sVQwot1/Rey07+Egl

    Score
    10/10
    gozi2200bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks