Overview

overview

10

Static

static

3

262590037c...18.dll

windows7-x64

10

262590037c...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    262590037c93a5496b38565c9dfc85d8_JaffaCakes118

  • Size

    335KB

  • Sample

    240704-zhw7fsxgln

  • MD5

    262590037c93a5496b38565c9dfc85d8

  • SHA1

    29616a643f896d6ab55d7129a813fa4056400c0e

  • SHA256

    eaeb42576fb19b866abdc99b5b8f867f3c69d8da9e941f2ca5af1f0e3e342a6c

  • SHA512

    c566f68a5d8b6769595836bffdf7e05b439a9a26ed7a500348a6ca4dea3effbdf0db1da64d219b7c6ac35143604782d5ffd47633a6297e3191224210d4de0bee

  • SSDEEP

    3072:lYEuU/HsL0icNk2S/G7xBYT147Q1zzWpYnJw19qVFXEqnQvSoLRRybz5m76nf7fF:ypGHq8ujuVeZWQ1WmnaHqrCybs+fbpC

Score
10/10
gozi4355bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

4355

C2

updates.microsoft.com

haloopolikosul.xyz

trapolikoliosilios.xyz
Attributes
  • base_path

    /manifest/

  • build

    250177

  • dga_season

    10

  • exe_type

    loader

  • extension

    .cnx

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      262590037c93a5496b38565c9dfc85d8_JaffaCakes118

    • Size

      335KB

    • MD5

      262590037c93a5496b38565c9dfc85d8

    • SHA1

      29616a643f896d6ab55d7129a813fa4056400c0e

    • SHA256

      eaeb42576fb19b866abdc99b5b8f867f3c69d8da9e941f2ca5af1f0e3e342a6c

    • SHA512

      c566f68a5d8b6769595836bffdf7e05b439a9a26ed7a500348a6ca4dea3effbdf0db1da64d219b7c6ac35143604782d5ffd47633a6297e3191224210d4de0bee

    • SSDEEP

      3072:lYEuU/HsL0icNk2S/G7xBYT147Q1zzWpYnJw19qVFXEqnQvSoLRRybz5m76nf7fF:ypGHq8ujuVeZWQ1WmnaHqrCybs+fbpC

    Score
    10/10
    gozi4355bankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks