Overview

overview

10

Static

static

3

JaffaCakes...5d.exe

windows7-x64

10

JaffaCakes...5d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d

  • Size

    156KB

  • Sample

    241222-bkbrjaxmcp

  • MD5

    80bea75a1b910a278bf3c5f3f368ad45

  • SHA1

    3c6d45f2a09ef3ff4e50df27712027ecaafa3b73

  • SHA256

    101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d

  • SHA512

    dbc5eeadde6f1b3afec438a33de5641c21f7415e39ba531a13b5beae4b717d95641ac8b486d94a57f681b0c0e83bd8446d3ac2f216ff424941fe8b4f4c897cae

  • SSDEEP

    3072:QDezOmX9ejaC+3cq2A2cpZBbe3qAY/KFE3Xruw2:VzfX9elbFinAYyyyr

Score
10/10
gozi4483bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

4483

C2

yahoo.com

doreuneruy.store

qorunegolu.club

https://doreuneruy.store

https://qorunegolu.club
Attributes
  • base_path

    /jdraw/

  • build

    250211

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • extension

    .crw

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      JaffaCakes118_101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d

    • Size

      156KB

    • MD5

      80bea75a1b910a278bf3c5f3f368ad45

    • SHA1

      3c6d45f2a09ef3ff4e50df27712027ecaafa3b73

    • SHA256

      101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d

    • SHA512

      dbc5eeadde6f1b3afec438a33de5641c21f7415e39ba531a13b5beae4b717d95641ac8b486d94a57f681b0c0e83bd8446d3ac2f216ff424941fe8b4f4c897cae

    • SSDEEP

      3072:QDezOmX9ejaC+3cq2A2cpZBbe3qAY/KFE3Xruw2:VzfX9elbFinAYyyyr

    Score
    10/10
    gozi4483bankerisfbtrojandiscovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks