Overview

overview

10

Static

static

3

786763762f...18.dll

windows7-x64

10

786763762f...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    786763762f8047daeb990363b12666da_JaffaCakes118

  • Size

    246KB

  • Sample

    240730-s9jbca1fjf

  • MD5

    786763762f8047daeb990363b12666da

  • SHA1

    8a635fa23deaac261be26146e6125c173cc86ec5

  • SHA256

    419eb40fb4fd8a27bb48393440043339198b8d608b59edc191abfbf57246f5de

  • SHA512

    52bb6fcd2444c8d257004d011d827e2f504bd46a1f9cc7c31df4292620d0e324c9dc50c9939e5717cd1e58665110c04b982022ee92973fe6d7c3b59a4b23844d

  • SSDEEP

    6144:Clhctou4dTS58kb13huenD5c/U8sVmhv5YJ2NMMhflne:yhctF4g5z3huwNSsVmh6JqMMXe

Score
10/10
gozi7221bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7221

C2

po3p53334.yahoo.com

web.citylimitshog.com
Attributes
  • build

    250154

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      786763762f8047daeb990363b12666da_JaffaCakes118

    • Size

      246KB

    • MD5

      786763762f8047daeb990363b12666da

    • SHA1

      8a635fa23deaac261be26146e6125c173cc86ec5

    • SHA256

      419eb40fb4fd8a27bb48393440043339198b8d608b59edc191abfbf57246f5de

    • SHA512

      52bb6fcd2444c8d257004d011d827e2f504bd46a1f9cc7c31df4292620d0e324c9dc50c9939e5717cd1e58665110c04b982022ee92973fe6d7c3b59a4b23844d

    • SSDEEP

      6144:Clhctou4dTS58kb13huenD5c/U8sVmhv5YJ2NMMhflne:yhctF4g5z3huwNSsVmh6JqMMXe

    Score
    10/10
    gozi7221bankerdiscoveryisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks