Overview

overview

10

Static

static

3

fa55383a34...18.dll

windows7-x64

10

fa55383a34...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa55383a348af93372b6610555dc23b8_JaffaCakes118

  • Size

    507KB

  • Sample

    240927-nq8pns1ajq

  • MD5

    fa55383a348af93372b6610555dc23b8

  • SHA1

    633536dab0c149c5e71505b7db0164e9f3b9598c

  • SHA256

    5b56be276354686b57f6145022daaa8f1e3257e0919e33b17ca1721a23f73403

  • SHA512

    f0195dbc7950dadbad24c9ad307ec17bc32c25ba8e8257a2836ca250ab84fc236134eaf5b588e45b7a3d4b21f8f30a57b83f396030fa82bf792f215e612d9876

  • SSDEEP

    12288:goJc07eBsFdketews58lc+YJsNZiRqgf4IiVLt+DCDV1z6O:dVQhwsylcTTF5DcN

Score
10/10
gozi2200bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

2200

C2

api10.laptok.at/api1

golang.feel500.at/api1

go.in100k.at/api1
Attributes
  • build

    250171

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    730

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      fa55383a348af93372b6610555dc23b8_JaffaCakes118

    • Size

      507KB

    • MD5

      fa55383a348af93372b6610555dc23b8

    • SHA1

      633536dab0c149c5e71505b7db0164e9f3b9598c

    • SHA256

      5b56be276354686b57f6145022daaa8f1e3257e0919e33b17ca1721a23f73403

    • SHA512

      f0195dbc7950dadbad24c9ad307ec17bc32c25ba8e8257a2836ca250ab84fc236134eaf5b588e45b7a3d4b21f8f30a57b83f396030fa82bf792f215e612d9876

    • SSDEEP

      12288:goJc07eBsFdketews58lc+YJsNZiRqgf4IiVLt+DCDV1z6O:dVQhwsylcTTF5DcN

    Score
    10/10
    gozi2200bankerdiscoveryisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks