Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-12-2024 12:55
General
-
Target
eedc6ece437f7a34abf793dc9400ae76_JaffaCakes118.exe
-
Size
467KB
-
MD5
eedc6ece437f7a34abf793dc9400ae76
-
SHA1
2e3e6f6faf8a9661ba46908a903da08a4126044b
-
SHA256
5cb9d7744b561570a529f2820f392dad98aa52c4dfd9ebe771a6381636fe8cae
-
SHA512
b3356777df19cabc9070682c3be2fdfbd93cd902136dfe829698fa9fa86cb495fb9732c27c42aa6510bd79ecc449e16ba0758d2727a1a877cbe99bb3c5173e0e
-
SSDEEP
6144:2DOcDOxAYNKc6oerYWfIZZVxYeOaUowKkxgkEfEUbfxCh0fO/W/cvd5nQH3lFCCs:2OcDOxAQKc4YWKe/7mvCh0CRvdP
Malware Config
Extracted
gozi
Extracted
gozi
3001
return901.ru
ferresita.ru
tmp1.super-list.ru
net7.dns9free.ru
new-recv.org.kz
-
exe_type
worker
-
server_id
12
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\eedc6ece437f7a34abf793dc9400ae76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eedc6ece437f7a34abf793dc9400ae76_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
484KB
-
Filesize
484KB