General

  • Target

    c0b9630fae2d9982b3bdf8e6265b69e0N.exe

  • Size

    163KB

  • Sample

    240814-cgqa7azbmm

  • MD5

    c0b9630fae2d9982b3bdf8e6265b69e0

  • SHA1

    f7453b6afa87d0b4ae82b06a88985d4bf358c729

  • SHA256

    97b605fd5f13f8438ed67c53b2c782afad486440c95a95a15b8b10339b583ae1

  • SHA512

    a9fc09462a8c130c1974aa33347395d62d69cff1a2f65a65a81b572ef2992c4cd3bd750ee68422cab0d835f36fd4982ca61272ad6dd0cefa0ec016a7e940f977

  • SSDEEP

    1536:PAPGV8lmExbwKsm5OYWiTYS/rpLlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:CY8s0LWiMupLltOrWKDBr+yJb

Malware Config

Extracted

Family

gozi

Targets

    • Target

      c0b9630fae2d9982b3bdf8e6265b69e0N.exe

    • Size

      163KB

    • MD5

      c0b9630fae2d9982b3bdf8e6265b69e0

    • SHA1

      f7453b6afa87d0b4ae82b06a88985d4bf358c729

    • SHA256

      97b605fd5f13f8438ed67c53b2c782afad486440c95a95a15b8b10339b583ae1

    • SHA512

      a9fc09462a8c130c1974aa33347395d62d69cff1a2f65a65a81b572ef2992c4cd3bd750ee68422cab0d835f36fd4982ca61272ad6dd0cefa0ec016a7e940f977

    • SSDEEP

      1536:PAPGV8lmExbwKsm5OYWiTYS/rpLlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:CY8s0LWiMupLltOrWKDBr+yJb

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks