Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22-12-2024 01:11
General
-
Target
JaffaCakes118_101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d.exe
-
Size
156KB
-
MD5
80bea75a1b910a278bf3c5f3f368ad45
-
SHA1
3c6d45f2a09ef3ff4e50df27712027ecaafa3b73
-
SHA256
101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d
-
SHA512
dbc5eeadde6f1b3afec438a33de5641c21f7415e39ba531a13b5beae4b717d95641ac8b486d94a57f681b0c0e83bd8446d3ac2f216ff424941fe8b4f4c897cae
-
SSDEEP
3072:QDezOmX9ejaC+3cq2A2cpZBbe3qAY/KFE3Xruw2:VzfX9elbFinAYyyyr
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
4483
C2
yahoo.com
doreuneruy.store
qorunegolu.club
https://doreuneruy.store
https://qorunegolu.club
Attributes
-
base_path
/jdraw/
-
build
250211
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
extension
.crw
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
60KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
188KB
-
Filesize
60KB