Overview

overview

10

Static

static

3

JaffaCakes...f8.dll

windows7-x64

10

JaffaCakes...f8.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b51976b4bcf5691429863370a149a7e9396a278663f1a80e338d99f46de8fef8

  • Size

    625KB

  • Sample

    241221-z3a5qazmbz

  • MD5

    974db4bf25aba9921000c44b8a69ab9f

  • SHA1

    134c3b1399e12bb8acc5ad8376e9833ff458c29e

  • SHA256

    b51976b4bcf5691429863370a149a7e9396a278663f1a80e338d99f46de8fef8

  • SHA512

    f63aa8704d586c6edd994b40a656f08c4eab7a12a193062a8c5773174baa782d92580d6f5b05aa84e6c725a77930201b044a9f8fa50028b5709efc396e57a248

  • SSDEEP

    12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZZ:+w1lEKOpuYxiwkkgjAN8ZZ

Score
10/10
gozi999bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142
Attributes
  • base_path

    /phpadmin/

  • build

    250227

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      JaffaCakes118_b51976b4bcf5691429863370a149a7e9396a278663f1a80e338d99f46de8fef8

    • Size

      625KB

    • MD5

      974db4bf25aba9921000c44b8a69ab9f

    • SHA1

      134c3b1399e12bb8acc5ad8376e9833ff458c29e

    • SHA256

      b51976b4bcf5691429863370a149a7e9396a278663f1a80e338d99f46de8fef8

    • SHA512

      f63aa8704d586c6edd994b40a656f08c4eab7a12a193062a8c5773174baa782d92580d6f5b05aa84e6c725a77930201b044a9f8fa50028b5709efc396e57a248

    • SSDEEP

      12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZZ:+w1lEKOpuYxiwkkgjAN8ZZ

    Score
    10/10
    gozi999bankerdiscoveryisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Gozi family

      gozi

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks