Overview

overview

10

Static

static

3

a4db77d838...18.exe

windows7-x64

10

a4db77d838...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a4db77d838edb48296656263e4195d6a_JaffaCakes118

  • Size

    203KB

  • Sample

    240613-lgvqcasgqh

  • MD5

    a4db77d838edb48296656263e4195d6a

  • SHA1

    a83f759e9d47b798a3b35f0b12340b9c1d215430

  • SHA256

    928ed10619e31e294434cb2d95f8e0ade1fa830cf60357fba27de3fc969ff522

  • SHA512

    68e835495caf4d749637e0aa74c5b1cc6991d9c88159742b928e1673268a17b2a7c16ceb47b88c881a202bab2370a88e7a9a612f16177cb6adb901b005bb2616

  • SSDEEP

    3072:9Hji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9Ldp4uPZzGonqXGXh0bluBc4GZ5

Score
10/10
gozi3162bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215165

Extracted

Family

gozi

Botnet

3162

C2

menehleibe.com

liemuteste.com

thulligend.com
Attributes
  • build

    215165

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      a4db77d838edb48296656263e4195d6a_JaffaCakes118

    • Size

      203KB

    • MD5

      a4db77d838edb48296656263e4195d6a

    • SHA1

      a83f759e9d47b798a3b35f0b12340b9c1d215430

    • SHA256

      928ed10619e31e294434cb2d95f8e0ade1fa830cf60357fba27de3fc969ff522

    • SHA512

      68e835495caf4d749637e0aa74c5b1cc6991d9c88159742b928e1673268a17b2a7c16ceb47b88c881a202bab2370a88e7a9a612f16177cb6adb901b005bb2616

    • SSDEEP

      3072:9Hji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9Ldp4uPZzGonqXGXh0bluBc4GZ5

    Score
    10/10
    gozi3162bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks