Overview

overview

10

Static

static

3

JaffaCakes...2a.dll

windows7-x64

10

JaffaCakes...2a.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_f90d90eea483b709bf2da668af667d1391bebf90d189dd8319e81a841db8912a

  • Size

    626KB

  • Sample

    241221-wxwmpavrhv

  • MD5

    4d62b207c2d237e210da98217916b10c

  • SHA1

    d04d9e0f2476e36691123b5d24318667f6a8b8ff

  • SHA256

    f90d90eea483b709bf2da668af667d1391bebf90d189dd8319e81a841db8912a

  • SHA512

    5cbeb63e87c605c75c7390aa661192eeadeba42675f5b71e86dc5b9c3bfde90dc5ba01c87aaba15459928f6d7f7347f59235f8a73da6a3b08cdeae1e47e7138a

  • SSDEEP

    12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZK:+w1lEKOpuYxiwkkgjAN8ZK

Score
10/10
gozi999bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142
Attributes
  • base_path

    /phpadmin/

  • build

    250227

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      JaffaCakes118_f90d90eea483b709bf2da668af667d1391bebf90d189dd8319e81a841db8912a

    • Size

      626KB

    • MD5

      4d62b207c2d237e210da98217916b10c

    • SHA1

      d04d9e0f2476e36691123b5d24318667f6a8b8ff

    • SHA256

      f90d90eea483b709bf2da668af667d1391bebf90d189dd8319e81a841db8912a

    • SHA512

      5cbeb63e87c605c75c7390aa661192eeadeba42675f5b71e86dc5b9c3bfde90dc5ba01c87aaba15459928f6d7f7347f59235f8a73da6a3b08cdeae1e47e7138a

    • SSDEEP

      12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZK:+w1lEKOpuYxiwkkgjAN8ZK

    Score
    10/10
    gozi999bankerdiscoveryisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Gozi family

      gozi

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks