Overview

overview

10

Static

static

3

9d85b49fe6...18.exe

windows7-x64

10

9d85b49fe6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d85b49fe6bc8493872e4ed6b86ecc82_JaffaCakes118

  • Size

    376KB

  • Sample

    240611-j21e8a1alp

  • MD5

    9d85b49fe6bc8493872e4ed6b86ecc82

  • SHA1

    6a3f9304f46aa5a7b0ac18ddd714f40fb525a354

  • SHA256

    825b34718e563891ad1e23e253f09d1e3167fef0f896b928bc98ec6dd5063582

  • SHA512

    27cfbfdea7497f4080f7dc846d88559e073408b25c18e62b44c3c5459b2e4def28339e2770054f1cf790904decdd0268aec9d193da8398f642df67d3c376cd5a

  • SSDEEP

    6144:tFqTpMmb37r+TiZNAqMRQzRZZxKxMFihFAziUQuLNMEC:t0NDmoNAF0RZZxKGIFAziUQuLN

Score
10/10
gozi3193bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214062

Extracted

Family

gozi

Botnet

3193

C2

fy76qn.email

dst1894.com

w40shailie.city
Attributes
  • build

    214062

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      9d85b49fe6bc8493872e4ed6b86ecc82_JaffaCakes118

    • Size

      376KB

    • MD5

      9d85b49fe6bc8493872e4ed6b86ecc82

    • SHA1

      6a3f9304f46aa5a7b0ac18ddd714f40fb525a354

    • SHA256

      825b34718e563891ad1e23e253f09d1e3167fef0f896b928bc98ec6dd5063582

    • SHA512

      27cfbfdea7497f4080f7dc846d88559e073408b25c18e62b44c3c5459b2e4def28339e2770054f1cf790904decdd0268aec9d193da8398f642df67d3c376cd5a

    • SSDEEP

      6144:tFqTpMmb37r+TiZNAqMRQzRZZxKxMFihFAziUQuLNMEC:t0NDmoNAF0RZZxKGIFAziUQuLN

    Score
    10/10
    gozi3193bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks