Overview

overview

10

Static

static

3

3b56b7298c...34.dll

windows7-x64

10

3b56b7298c...34.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_192ae21881fe7e948c5fffc3bc1f44f904a7136d3fd251062fa304648c8a7571

  • Size

    378KB

  • Sample

    241221-27rdlstmem

  • MD5

    98874c0b3a857f47f36959e10c8f67ba

  • SHA1

    975f3d0c2d815af3174a9a97cfe1d8aab04aa5df

  • SHA256

    192ae21881fe7e948c5fffc3bc1f44f904a7136d3fd251062fa304648c8a7571

  • SHA512

    7c9d610718f676c67cd8cd5698725f458cdc1e667489b7b9a7a2f43aadb72bdc79e30bc0b0e7c6021edfcd3756d21cebedc092cd6cd264204a6b233e1ac60a56

  • SSDEEP

    6144:pvg3f8jUwB1CwwUimghKZiMaagrK1E+eA7JeCFhi9kCUQTphHXRJN1kvjAKx3sOS:Rg3EjH3w5mgQAMaagieA7Mei9kCTFhBZ

Score
10/10
gozi8877bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

8877

C2

outlook.com/login

gmail.com

worunekulo.club

horunekulo.website
Attributes
  • base_path

    /greed/

  • build

    250196

  • dga_season

    10

  • exe_type

    loader

  • extension

    .gfk

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34.dll

    • Size

      821KB

    • MD5

      50a299d1e92d9205e123404c8e05904d

    • SHA1

      c188272ab757dbbf14e74781fc90fcefe4aeb615

    • SHA256

      3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34

    • SHA512

      ec30f36d70ddbb6ba4aaccb3342e0a0ffbd586d2784370500a94e33aa650d1c56d3712ffc3a9e15a0558194ce26d1b76d9f2a8953220684bef634e57f4579df1

    • SSDEEP

      12288:mzCoYRvNZrA8Res/TPUOjUUGcqcoWEx9kMGUS6vOV5y4gnuD5wtqqB7ol:VdNZr5RLL1AZ/clUnHvk5hgU

    Score
    10/10
    gozi8877bankerdiscoveryisfbtrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks