Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e92fd4b12a...18.exe

windows7-x64

10

e92fd4b12a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e92fd4b12a39b65b82f5ea4e64cfd631_JaffaCakes118

  • Size

    376KB

  • Sample

    240918-qcqm2stbpr

  • MD5

    e92fd4b12a39b65b82f5ea4e64cfd631

  • SHA1

    a2c1d3160563291926ad722bb15a32524e88cf18

  • SHA256

    0e90afa21e08ea2e99dd769fa9d08e4a89df749dc20e036306de26f576845cbc

  • SHA512

    332018d39e96a06e0672163e39ba5aaab199b630e0e7cf9ddc07942b939025ffaf1d9f5dcc333217e11519f26e42db0420cc532db4c2c0a9b8838aafa222a55d

  • SSDEEP

    3072:hkyrSmefi8xQRv00gDg4JbUrQrY17hJHe0KuVuPi6d+YShwaqz+UQc/uGkn3dK:hkal2i8WjgDjY9hhFxTyUOaMkN

Score
10/10
gozi3195bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Botnet

3195

C2

nsyblefgg.city

m25lni11528.com

dgrover.band
Attributes
  • build

    214062

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      e92fd4b12a39b65b82f5ea4e64cfd631_JaffaCakes118

    • Size

      376KB

    • MD5

      e92fd4b12a39b65b82f5ea4e64cfd631

    • SHA1

      a2c1d3160563291926ad722bb15a32524e88cf18

    • SHA256

      0e90afa21e08ea2e99dd769fa9d08e4a89df749dc20e036306de26f576845cbc

    • SHA512

      332018d39e96a06e0672163e39ba5aaab199b630e0e7cf9ddc07942b939025ffaf1d9f5dcc333217e11519f26e42db0420cc532db4c2c0a9b8838aafa222a55d

    • SSDEEP

      3072:hkyrSmefi8xQRv00gDg4JbUrQrY17hJHe0KuVuPi6d+YShwaqz+UQc/uGkn3dK:hkal2i8WjgDjY9hhFxTyUOaMkN

    Score
    10/10
    gozi3195bankerdiscoveryisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks