Overview

overview

10

Static

static

3

04d6963ab0...29.dll

windows7-x64

10

04d6963ab0...29.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04d6963ab02c1f483cb9ff7af68c15456740099de5dd84dc68a77e9511772129

  • Size

    761KB

  • Sample

    241219-x8ezraxqfs

  • MD5

    daacc7852627bd0e71b8e3d2a4a6543b

  • SHA1

    f47462d2b9d2b375684f98f011e399c25fe2e7dd

  • SHA256

    04d6963ab02c1f483cb9ff7af68c15456740099de5dd84dc68a77e9511772129

  • SHA512

    4c6fe5679e123443c3ec19094683ba834dbec0515b56bcde43c33d423db2684b108d6f9c457c9c10daa4765054c7d8bdc163b59a2c75464c42d7bcb6a18b2cd8

  • SSDEEP

    12288:JauX9Io7goxCqOJC0g+j4gBoB3KD/KZExnbCZwcSeVX6OF+XN15xJgiC42D6r3ec:Jah7oYJRrLDSZExnbCvSyF+XW/6T

Score
10/10
gozi1000bankerdiscoveryisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1000

C2

http://ey7kuuklgieop2pq.onion

http://maiamirainy.at

http://drunt.at

http://news-deck.at
Attributes
  • build

    216098

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      04d6963ab02c1f483cb9ff7af68c15456740099de5dd84dc68a77e9511772129

    • Size

      761KB

    • MD5

      daacc7852627bd0e71b8e3d2a4a6543b

    • SHA1

      f47462d2b9d2b375684f98f011e399c25fe2e7dd

    • SHA256

      04d6963ab02c1f483cb9ff7af68c15456740099de5dd84dc68a77e9511772129

    • SHA512

      4c6fe5679e123443c3ec19094683ba834dbec0515b56bcde43c33d423db2684b108d6f9c457c9c10daa4765054c7d8bdc163b59a2c75464c42d7bcb6a18b2cd8

    • SSDEEP

      12288:JauX9Io7goxCqOJC0g+j4gBoB3KD/KZExnbCZwcSeVX6OF+XN15xJgiC42D6r3ec:Jah7oYJRrLDSZExnbCvSyF+XW/6T

    Score
    10/10
    gozi1000bankerdiscoveryisfbpersistencetrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Gozi family

      gozi

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks