General

  • Target

    c5384f79052f6098223f4a734208c250N.exe

  • Size

    163KB

  • Sample

    240814-p4dbcsxgmp

  • MD5

    c5384f79052f6098223f4a734208c250

  • SHA1

    c745db3c768f5429ba95cb2a94b25e93c5e46d20

  • SHA256

    8108c4d5aa90b3a62b0a063245f78505d0a4107dfc693aa6d22d2b970a6023c1

  • SHA512

    e913277dfe65010ab2f8ee977f5ea3380f1c60678a64241b02553a71d563b9f7de57b3aa0fe761e08ba3f9972a0dbda7296fe80c95c8b305a2ac2c14befec0cc

  • SSDEEP

    1536:PMk2HLUbjVIaJ1aQWwgp6I0VXMQKjAjqoElProNVU4qNVUrk/9QbfBr+7GwKrPAS:dWLKVIcaQWbt0V80EltOrWKDBr+yJb

Malware Config

Extracted

Family

gozi

Targets

    • Target

      c5384f79052f6098223f4a734208c250N.exe

    • Size

      163KB

    • MD5

      c5384f79052f6098223f4a734208c250

    • SHA1

      c745db3c768f5429ba95cb2a94b25e93c5e46d20

    • SHA256

      8108c4d5aa90b3a62b0a063245f78505d0a4107dfc693aa6d22d2b970a6023c1

    • SHA512

      e913277dfe65010ab2f8ee977f5ea3380f1c60678a64241b02553a71d563b9f7de57b3aa0fe761e08ba3f9972a0dbda7296fe80c95c8b305a2ac2c14befec0cc

    • SSDEEP

      1536:PMk2HLUbjVIaJ1aQWwgp6I0VXMQKjAjqoElProNVU4qNVUrk/9QbfBr+7GwKrPAS:dWLKVIcaQWbt0V80EltOrWKDBr+yJb

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks