General

  • Target

    872b5a53a8b559e070f873c5913386c7aa6e73df06060a446a13a045fd7ce5b9

  • Size

    163KB

  • Sample

    240728-ba6txsycqk

  • MD5

    051ffdf89c1d26750fc4c5ba2473d988

  • SHA1

    40cb32d366fa2c0dc0e30c4eca7477c76790fee7

  • SHA256

    872b5a53a8b559e070f873c5913386c7aa6e73df06060a446a13a045fd7ce5b9

  • SHA512

    35b50c97bddaffbfca3eebf208f101b70e797fb166eb77ac6061c5c8e2a29b0c1feb0ce4246595637f2fddeee7fff1bd73c41a2cca238f7493540d1f1c2a0d03

  • SSDEEP

    3072:kim7RjuHDBqC15Y2imRD/DTX1ltOrWKDBr+yJb:kim7RjuHDBqCZimRDbj1LOf

Malware Config

Extracted

Family

gozi

Targets

    • Target

      872b5a53a8b559e070f873c5913386c7aa6e73df06060a446a13a045fd7ce5b9

    • Size

      163KB

    • MD5

      051ffdf89c1d26750fc4c5ba2473d988

    • SHA1

      40cb32d366fa2c0dc0e30c4eca7477c76790fee7

    • SHA256

      872b5a53a8b559e070f873c5913386c7aa6e73df06060a446a13a045fd7ce5b9

    • SHA512

      35b50c97bddaffbfca3eebf208f101b70e797fb166eb77ac6061c5c8e2a29b0c1feb0ce4246595637f2fddeee7fff1bd73c41a2cca238f7493540d1f1c2a0d03

    • SSDEEP

      3072:kim7RjuHDBqC15Y2imRD/DTX1ltOrWKDBr+yJb:kim7RjuHDBqCZimRDbj1LOf

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks