General

  • Target

    da7a0555db1c2070506d3ceb69a50760N.exe

  • Size

    163KB

  • Sample

    240814-stjbeazbnd

  • MD5

    da7a0555db1c2070506d3ceb69a50760

  • SHA1

    ecd11876958211a71d9afe55280637f90c7aef5e

  • SHA256

    35be2cb6bbf7d6c004f589d3517d004c081a59172c9e691c5d2aa82976f1490c

  • SHA512

    c763275c3a04ed996a2638abddfb42eb9fd91372aef62076fb628e5de43cac8c7a8520ab96c7facf417635f90c777c81d119cc7bd7e57ee24ebb2b52b51d62f5

  • SSDEEP

    3072:AqiTiZXLluyJo68Dr0UbltOrWKDBr+yJb:lsiZXDoTbLOf

Malware Config

Extracted

Family

gozi

Targets

    • Target

      da7a0555db1c2070506d3ceb69a50760N.exe

    • Size

      163KB

    • MD5

      da7a0555db1c2070506d3ceb69a50760

    • SHA1

      ecd11876958211a71d9afe55280637f90c7aef5e

    • SHA256

      35be2cb6bbf7d6c004f589d3517d004c081a59172c9e691c5d2aa82976f1490c

    • SHA512

      c763275c3a04ed996a2638abddfb42eb9fd91372aef62076fb628e5de43cac8c7a8520ab96c7facf417635f90c777c81d119cc7bd7e57ee24ebb2b52b51d62f5

    • SSDEEP

      3072:AqiTiZXLluyJo68Dr0UbltOrWKDBr+yJb:lsiZXDoTbLOf

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks