Overview

overview

10

Static

static

3

9b45107e63...18.exe

windows7-x64

10

9b45107e63...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9b45107e63f8cf2b0d659eb22132200f_JaffaCakes118

  • Size

    324KB

  • Sample

    240610-tpxhxasgld

  • MD5

    9b45107e63f8cf2b0d659eb22132200f

  • SHA1

    0c5768c5e36ace606a0b95153c1da6ff89d2dea8

  • SHA256

    a3b9e1b3284b175bf1f7f199489bef78ebdca75618d2b66e1f99c298eb79132d

  • SHA512

    c5f35094791480cb05b374a1924adce3dc586f9b7ee3b7b44be7810949b209c8fc8d9143478580e7466ee4cb2d0ba4c30e5ae7298fb71c94c87ae17705ddfd1e

  • SSDEEP

    6144:MwWEGMHLDO8+IEsOCj+PlTUtEyor6rPPPMtMQKdv69J07uQ:MTEGmO8+IEsOo+dyn/j6J07

Score
10/10
gozi3423bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214085

Extracted

Family

gozi

Botnet

3423

C2

google.com

gmail.com

sizfjalenk51.com

v25brigittet.com

k23ueugeniay.com
Attributes
  • build

    214085

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      9b45107e63f8cf2b0d659eb22132200f_JaffaCakes118

    • Size

      324KB

    • MD5

      9b45107e63f8cf2b0d659eb22132200f

    • SHA1

      0c5768c5e36ace606a0b95153c1da6ff89d2dea8

    • SHA256

      a3b9e1b3284b175bf1f7f199489bef78ebdca75618d2b66e1f99c298eb79132d

    • SHA512

      c5f35094791480cb05b374a1924adce3dc586f9b7ee3b7b44be7810949b209c8fc8d9143478580e7466ee4cb2d0ba4c30e5ae7298fb71c94c87ae17705ddfd1e

    • SSDEEP

      6144:MwWEGMHLDO8+IEsOCj+PlTUtEyor6rPPPMtMQKdv69J07uQ:MTEGmO8+IEsOo+dyn/j6J07

    Score
    10/10
    gozi3423bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks