General

  • Target

    2db7dc6d308382c95a066b798a8f83bc_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241009-j4amksxdmk

  • MD5

    2db7dc6d308382c95a066b798a8f83bc

  • SHA1

    9ce24008a8e446d6fecf29f5db69c582c0d34fe1

  • SHA256

    4cef6e60b966b6096985dc9cf9c5b16e4618d4ec8167163c35cbb7b7926988c6

  • SHA512

    b639bf87ab4f2f97f5450ab773f5b8255a9067fcfdb1a60dcf3d3fda81db70266eec3dae8a707f215efb2b198353b4486170b2d6abf1cbf3610f350e53551e5e

  • SSDEEP

    24576:jESqIkRxn/tXZuIN8HddNlKg9NIaYTHwOl62gamF8OpO8LvG:jT/slXMw8HddNlKgqTH9I1p3

Malware Config

Extracted

Family

gozi

Targets

    • Target

      2db7dc6d308382c95a066b798a8f83bc_JaffaCakes118

    • Size

      1.3MB

    • MD5

      2db7dc6d308382c95a066b798a8f83bc

    • SHA1

      9ce24008a8e446d6fecf29f5db69c582c0d34fe1

    • SHA256

      4cef6e60b966b6096985dc9cf9c5b16e4618d4ec8167163c35cbb7b7926988c6

    • SHA512

      b639bf87ab4f2f97f5450ab773f5b8255a9067fcfdb1a60dcf3d3fda81db70266eec3dae8a707f215efb2b198353b4486170b2d6abf1cbf3610f350e53551e5e

    • SSDEEP

      24576:jESqIkRxn/tXZuIN8HddNlKg9NIaYTHwOl62gamF8OpO8LvG:jT/slXMw8HddNlKgqTH9I1p3

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks