gozi | fd778cd2f02d549347df0cae2f1a55cfc2d6f73e975d8b88489d04d2447f7ebc | Triage

Sharing

General

Target

ed380a4338d439ca09a6e375501a72c8_JaffaCakes118
Size

52KB
Sample

241213-3gvtsa1nav
MD5

ed380a4338d439ca09a6e375501a72c8
SHA1

11b4d0d7a4fc1294c4a26a12f491f1019c9b9c17
SHA256

fd778cd2f02d549347df0cae2f1a55cfc2d6f73e975d8b88489d04d2447f7ebc
SHA512

2e1a7c539ee1386141da7954de7e090e70018140c143dcc039c9463738a7893a45a657655ee81d0791624344c3bc36112e0df93503ab0d9f477a8879c37d2ae2
SSDEEP

1536:fmJOqW9qZG4Gz5lNjSnoQc064Me59jCfrCwuv9T:uo9rz5lNjSno6dMebWuwuv9

Score

10^/10

gozi 86920234 banker discovery rm3 trojan

Malware Config

Extracted

Family

gozi

Attributes

build
300898

Extracted

Family

gozi

Botnet

86920234

C2

https://susanslewis.xyz

Attributes

build
300898
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  ed380a4338d439ca09a6e375501a72c8_JaffaCakes118
- Size
  
  52KB
- MD5
  
  ed380a4338d439ca09a6e375501a72c8
- SHA1
  
  11b4d0d7a4fc1294c4a26a12f491f1019c9b9c17
- SHA256
  
  fd778cd2f02d549347df0cae2f1a55cfc2d6f73e975d8b88489d04d2447f7ebc
- SHA512
  
  2e1a7c539ee1386141da7954de7e090e70018140c143dcc039c9463738a7893a45a657655ee81d0791624344c3bc36112e0df93503ab0d9f477a8879c37d2ae2
- SSDEEP
  
  1536:fmJOqW9qZG4Gz5lNjSnoQc064Me59jCfrCwuv9T:uo9rz5lNjSno6dMebWuwuv9
Score

10^/10

gozi 86920234 banker discovery rm3 trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Gozi family
  gozi
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi86920234bankerdiscoveryrm3trojan

behavioral2

gozi86920234bankerdiscoveryrm3trojan