Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

d8ff579aa7...18.exe

windows7-x64

10

d8ff579aa7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8ff579aa7fa4f9e658dc98b597c8a42_JaffaCakes118

  • Size

    250KB

  • Sample

    240910-zarl1atfjr

  • MD5

    d8ff579aa7fa4f9e658dc98b597c8a42

  • SHA1

    51877ef77b94248737ba58ae7f67c9e8e493c4eb

  • SHA256

    9d6dd00b22e2059d7848f8d32e79f4c68ef38c4e63793893a76027e617a7e377

  • SHA512

    0a48f026c3ec6563590115eb1525cd359506ea9406f3feca2ef7b95fb6d951ab984e9bb6fb0da8d915aea4f6b42f5105ce1dbfd790e478c19c71023060186899

  • SSDEEP

    3072:IFNthWQl/rSJ7lvt9filcZritkrINAEYsm2:IBhWQ/mJLflrOAp2

Score
10/10
gozi92020311bankerdiscoveryrm3trojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    300913

Extracted

Family

gozi

Botnet

92020311

C2

https://appealingedge.xyz

Attributes
  • build

    300913

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • non_target_locale

    RU

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      d8ff579aa7fa4f9e658dc98b597c8a42_JaffaCakes118

    • Size

      250KB

    • MD5

      d8ff579aa7fa4f9e658dc98b597c8a42

    • SHA1

      51877ef77b94248737ba58ae7f67c9e8e493c4eb

    • SHA256

      9d6dd00b22e2059d7848f8d32e79f4c68ef38c4e63793893a76027e617a7e377

    • SHA512

      0a48f026c3ec6563590115eb1525cd359506ea9406f3feca2ef7b95fb6d951ab984e9bb6fb0da8d915aea4f6b42f5105ce1dbfd790e478c19c71023060186899

    • SSDEEP

      3072:IFNthWQl/rSJ7lvt9filcZritkrINAEYsm2:IBhWQ/mJLflrOAp2

    Score
    10/10
    gozi92020311bankerdiscoveryrm3trojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks