General

  • Target

    JaffaCakes118_213fa9c43678bccdf3e463e2d28319d4e37ab4588ca3ce1022a4c5138e81a78a

  • Size

    626KB

  • Sample

    241221-3qetxsvjhp

  • MD5

    a8c7acbf3754b66476c5f26778fb5730

  • SHA1

    a1dd522b4411c541e0a7981a4e590c8aa1157829

  • SHA256

    213fa9c43678bccdf3e463e2d28319d4e37ab4588ca3ce1022a4c5138e81a78a

  • SHA512

    eb965395c4fa33119ab5a1e53e03d5888b0cfe0725cf41105b7ccc2dba9fd64896af8b71b33ae9bbca82af2198d19ba796031467b120b81f62bfa0cc5dfa7d29

  • SSDEEP

    12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Zm:+w1lEKOpuYxiwkkgjAN8Zm

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142

Attributes
  • base_path

    /phpadmin/

  • build

    250227

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      JaffaCakes118_213fa9c43678bccdf3e463e2d28319d4e37ab4588ca3ce1022a4c5138e81a78a

    • Size

      626KB

    • MD5

      a8c7acbf3754b66476c5f26778fb5730

    • SHA1

      a1dd522b4411c541e0a7981a4e590c8aa1157829

    • SHA256

      213fa9c43678bccdf3e463e2d28319d4e37ab4588ca3ce1022a4c5138e81a78a

    • SHA512

      eb965395c4fa33119ab5a1e53e03d5888b0cfe0725cf41105b7ccc2dba9fd64896af8b71b33ae9bbca82af2198d19ba796031467b120b81f62bfa0cc5dfa7d29

    • SSDEEP

      12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Zm:+w1lEKOpuYxiwkkgjAN8Zm

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Gozi family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks