Overview

overview

10

Static

static

3

ff0b8bdf75...18.exe

windows7-x64

10

ff0b8bdf75...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff0b8bdf7576aab2c0c32590e11c0c36_JaffaCakes118

  • Size

    203KB

  • Sample

    240929-waxlgaxdkb

  • MD5

    ff0b8bdf7576aab2c0c32590e11c0c36

  • SHA1

    72fca6865972e48b7781efc9af9290cd28c61cca

  • SHA256

    ebf5cce0f863d898ddac6b4621fcbf38b173125e327a1aa22a6c7265828c0a65

  • SHA512

    f52286905891eba573012c0cc58e59d042144f96a737279e70910731144b519d12ae7f03710aa9f80f6f6a1ed77a70a0b84917f6780f711603938b830e2aa170

  • SSDEEP

    3072:9Nji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9Rdp4uPZzGonqXGXh0bluBc4GZ5

Score
10/10
gozi3162bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215165

Extracted

Family

gozi

Botnet

3162

C2

menehleibe.com

liemuteste.com

thulligend.com
Attributes
  • build

    215165

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      ff0b8bdf7576aab2c0c32590e11c0c36_JaffaCakes118

    • Size

      203KB

    • MD5

      ff0b8bdf7576aab2c0c32590e11c0c36

    • SHA1

      72fca6865972e48b7781efc9af9290cd28c61cca

    • SHA256

      ebf5cce0f863d898ddac6b4621fcbf38b173125e327a1aa22a6c7265828c0a65

    • SHA512

      f52286905891eba573012c0cc58e59d042144f96a737279e70910731144b519d12ae7f03710aa9f80f6f6a1ed77a70a0b84917f6780f711603938b830e2aa170

    • SSDEEP

      3072:9Nji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9Rdp4uPZzGonqXGXh0bluBc4GZ5

    Score
    10/10
    gozi3162bankerdiscoveryisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks