gozi

General

Target

e0c536b519a383a6773dcbfa307cedb7_JaffaCakes118
Size

506KB
Sample

241211-k77bdswnbx
MD5

e0c536b519a383a6773dcbfa307cedb7
SHA1

2362c70330f68a87d01c896f5f8b8842fd44600a
SHA256

bb92a89b3517dd67e060aaf7bce721182a9a2d2af5bf1f15584fbe99f39261ec
SHA512

4fbd3e900c9e575ca948ba2b4253ed14dec22dfdbb61581789289c49508f4d756ca9a98880646bc0f0c093dac17b9d124d49136152b0a14901e0e2246e5eba54
SSDEEP

12288:GyjuagFPhiFen4Yww3c+fP5odPxezhif96Fy2x2b:GguagFPh0en4JwMg5olxezhigF92b

Score

10^/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1005

C2

fia-secure-connect.ru

moriyurw368798.ru

worldparuoli.ru

unikymprogress.ru

ferarirecord.ru

Attributes

exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  e0c536b519a383a6773dcbfa307cedb7_JaffaCakes118
- Size
  
  506KB
- MD5
  
  e0c536b519a383a6773dcbfa307cedb7
- SHA1
  
  2362c70330f68a87d01c896f5f8b8842fd44600a
- SHA256
  
  bb92a89b3517dd67e060aaf7bce721182a9a2d2af5bf1f15584fbe99f39261ec
- SHA512
  
  4fbd3e900c9e575ca948ba2b4253ed14dec22dfdbb61581789289c49508f4d756ca9a98880646bc0f0c093dac17b9d124d49136152b0a14901e0e2246e5eba54
- SSDEEP
  
  12288:GyjuagFPhiFen4Yww3c+fP5odPxezhif96Fy2x2b:GguagFPh0en4JwMg5olxezhigF92b
Score

10^/10

gozi 1005 banker discovery isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Gozi family
  gozi
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Gozi family

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2