Overview

overview

10

Static

static

10

513789aa7d...18.dll

windows7-x64

10

513789aa7d...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    513789aa7df7e5e4946db3abebae67d9_JaffaCakes118

  • Size

    213KB

  • MD5

    513789aa7df7e5e4946db3abebae67d9

  • SHA1

    e3c5dafdd760ce784db60f4246f6fa03f6d658d2

  • SHA256

    2d9b9de594b0e492d22258446ddf99e3962cfd5024345702aa3070a5d77e4c60

  • SHA512

    f471bbe3e0d7a33f28e868c563ccb526713a514c7b8afbc38817c8a7b5bda16cb7ea2303cbbf5eb72902c64ff3344eae632bc098185c99877102909f24866e95

  • SSDEEP

    3072:HUaaULsZBelnhgJjGCL0pYQjI383dyUtq2sbtlroFeq+io3iIDPCiZpFip:HNaULUBelhgQCL0aVedyn5po8q+iSCp

Score
10/10
isfb1001gozi

Malware Config

Extracted

Family

gozi

Botnet

1001

Attributes
  • build

    215840

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • exe_type

    worker

  • server_id

    93

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 513789aa7df7e5e4946db3abebae67d9_JaffaCakes118
    .dll windows:4 windows x64 arch:x64

    e75003ca3315f20cb9f243b8f927e406


    Headers

    Imports

    Sections