Overview

overview

10

Static

static

3

a3743cfb36...18.exe

windows7-x64

10

a3743cfb36...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a3743cfb36155f8fe0480e490f4d1ee2_JaffaCakes118

  • Size

    354KB

  • Sample

    240613-cb1jzazfqc

  • MD5

    a3743cfb36155f8fe0480e490f4d1ee2

  • SHA1

    1855d50cacd57ad6372f69b94028e6569da3ab2b

  • SHA256

    77abecb68b1c48a860990b357da81c8f11a7935321ae0b8263a39b9430ed06c1

  • SHA512

    faf5741263f95fe82b02164c349bf864b51a9aeb413b2c613052da739c8fd6b5357c364ff3d47a43a679664d76ca9700e0516f93d68480a032ae13df124b69e1

  • SSDEEP

    6144:jqp7pQMOtvhiNyVyZHbzU5/JMi+xLus/AWQB9X:opWhcyIZHnU5RPu4B9X

Score
10/10
gozi3177bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214062

Extracted

Family

gozi

Botnet

3177

C2

wgcjeremy11.band

skelsigabriella.fun

xelectauishanie.email
Attributes
  • build

    214062

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      a3743cfb36155f8fe0480e490f4d1ee2_JaffaCakes118

    • Size

      354KB

    • MD5

      a3743cfb36155f8fe0480e490f4d1ee2

    • SHA1

      1855d50cacd57ad6372f69b94028e6569da3ab2b

    • SHA256

      77abecb68b1c48a860990b357da81c8f11a7935321ae0b8263a39b9430ed06c1

    • SHA512

      faf5741263f95fe82b02164c349bf864b51a9aeb413b2c613052da739c8fd6b5357c364ff3d47a43a679664d76ca9700e0516f93d68480a032ae13df124b69e1

    • SSDEEP

      6144:jqp7pQMOtvhiNyVyZHbzU5/JMi+xLus/AWQB9X:opWhcyIZHnU5RPu4B9X

    Score
    10/10
    gozi3177bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks