Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

d832f5a807...18.dll

windows7-x64

10

d832f5a807...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d832f5a807170a8ef0f436810a58e2cb_JaffaCakes118

  • Size

    396KB

  • Sample

    240910-nrbfkatdqh

  • MD5

    d832f5a807170a8ef0f436810a58e2cb

  • SHA1

    4a6de46a421915bfc08a3c3f2e30a791132606ec

  • SHA256

    394ecd747f9b75d73b9d9fb0e393c754ce030e1cccf6c2544fd6eb54578cd517

  • SHA512

    14c93518b16a8b34dbb297e9a8bdacbee2ec70985e851618eb8a8c2c8a9f34cfe759d372750cb75e237be37b31fccf72847e61b72cd93d2fb306a703e6d59170

  • SSDEEP

    12288:4XxrsWwDQ6tsZgFi43nrxHIS/zjtp23T:4Xxrs9M6tsA1db/zj323

Score
10/10
gozi7221bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7221

C2

po3p53334.yahoo.com

web.citylimitshog.com
Attributes
  • build

    250154

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      d832f5a807170a8ef0f436810a58e2cb_JaffaCakes118

    • Size

      396KB

    • MD5

      d832f5a807170a8ef0f436810a58e2cb

    • SHA1

      4a6de46a421915bfc08a3c3f2e30a791132606ec

    • SHA256

      394ecd747f9b75d73b9d9fb0e393c754ce030e1cccf6c2544fd6eb54578cd517

    • SHA512

      14c93518b16a8b34dbb297e9a8bdacbee2ec70985e851618eb8a8c2c8a9f34cfe759d372750cb75e237be37b31fccf72847e61b72cd93d2fb306a703e6d59170

    • SSDEEP

      12288:4XxrsWwDQ6tsZgFi43nrxHIS/zjtp23T:4Xxrs9M6tsA1db/zj323

    Score
    10/10
    gozi7221bankerdiscoveryisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks