gozi | fa3f25ee2c2391baeea072e52a02b281cb08d32286ddae1c32661e225b970a3b | Triage

Sharing

General

Target

e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118
Size

1.3MB
Sample

240915-sv1xvazeqf
MD5

e2cce01aab8cd586d0f64acc5a2e74e5
SHA1

e52f0ce5f6e87df8d5a1c58d44adae3f5e7b56bd
SHA256

fa3f25ee2c2391baeea072e52a02b281cb08d32286ddae1c32661e225b970a3b
SHA512

f7c310d92f78a1ab4171703e4a674ccc504bd79fdaeb0a8c954eb9eb029708039cd7353af92ed5e7669808bb1193f2a3ab8c68f95138f7cf74f18ad930047c4b
SSDEEP

24576:PdG6kjWH7if1plcLK99o5z6X/TMqsbtWzMci1PkeJizMf2Gmfdmr61r:VLk1IK99o5OYqy8Mt2ecYuHj1r

Score

10^/10

gozi discovery evasion isfb trojan

Malware Config

Extracted

Family

gozi

Targets

- Target
  
  e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  e2cce01aab8cd586d0f64acc5a2e74e5
- SHA1
  
  e52f0ce5f6e87df8d5a1c58d44adae3f5e7b56bd
- SHA256
  
  fa3f25ee2c2391baeea072e52a02b281cb08d32286ddae1c32661e225b970a3b
- SHA512
  
  f7c310d92f78a1ab4171703e4a674ccc504bd79fdaeb0a8c954eb9eb029708039cd7353af92ed5e7669808bb1193f2a3ab8c68f95138f7cf74f18ad930047c4b
- SSDEEP
  
  24576:PdG6kjWH7if1plcLK99o5z6X/TMqsbtWzMci1PkeJizMf2Gmfdmr61r:VLk1IK99o5OYqy8Mt2ecYuHj1r
Score

8^/10

discovery evasion trojan
- Drops file in Drivers directory
- Executes dropped EXE
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasiontrojan