Overview

overview

10

Static

static

3

a2405d4234...18.exe

windows7-x64

10

a2405d4234...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2405d4234ad3482d3e61d0fc8801995_JaffaCakes118

  • Size

    203KB

  • Sample

    240612-zfawfayhrb

  • MD5

    a2405d4234ad3482d3e61d0fc8801995

  • SHA1

    a08a672d393af861efc836c5719269dd39884adf

  • SHA256

    168dca49b45b44a037a625ef0c24e6833df92b88d95a6f6ec19d678c290bad51

  • SHA512

    bd3ae4b0b37b8ff486244090bcc3c3d2a92e918ef6b72dcd7e38984ab5f107696766beef6b085bb2d08e35037b7747fc26aa98170d5d84d22354891052dea559

  • SSDEEP

    3072:9nji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9rdp4uPZzGonqXGXh0bluBc4GZ5

Score
10/10
gozi3162bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215165

Extracted

Family

gozi

Botnet

3162

C2

menehleibe.com

liemuteste.com

thulligend.com
Attributes
  • build

    215165

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      a2405d4234ad3482d3e61d0fc8801995_JaffaCakes118

    • Size

      203KB

    • MD5

      a2405d4234ad3482d3e61d0fc8801995

    • SHA1

      a08a672d393af861efc836c5719269dd39884adf

    • SHA256

      168dca49b45b44a037a625ef0c24e6833df92b88d95a6f6ec19d678c290bad51

    • SHA512

      bd3ae4b0b37b8ff486244090bcc3c3d2a92e918ef6b72dcd7e38984ab5f107696766beef6b085bb2d08e35037b7747fc26aa98170d5d84d22354891052dea559

    • SSDEEP

      3072:9nji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9rdp4uPZzGonqXGXh0bluBc4GZ5

    Score
    10/10
    gozi3162bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks