Overview

overview

10

Static

static

3

JaffaCakes...5d.exe

windows7-x64

10

JaffaCakes...5d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 01:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d.exe

  • Size

    156KB

  • MD5

    80bea75a1b910a278bf3c5f3f368ad45

  • SHA1

    3c6d45f2a09ef3ff4e50df27712027ecaafa3b73

  • SHA256

    101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d

  • SHA512

    dbc5eeadde6f1b3afec438a33de5641c21f7415e39ba531a13b5beae4b717d95641ac8b486d94a57f681b0c0e83bd8446d3ac2f216ff424941fe8b4f4c897cae

  • SSDEEP

    3072:QDezOmX9ejaC+3cq2A2cpZBbe3qAY/KFE3Xruw2:VzfX9elbFinAYyyyr

Score
10/10
gozi4483bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

4483

C2

yahoo.com

doreuneruy.store

qorunegolu.club

https://doreuneruy.store

https://qorunegolu.club
Attributes
  • base_path

    /jdraw/

  • build

    250211

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • extension

    .crw

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Gozi family
    gozi
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_101bdc0d998033c8ad03ab17cfb80f1cf62cf8c4e3b14b83befd6c46440fc25d.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:8

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/8-0-0x00000000005D0000-0x00000000005DB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/8-1-0x0000000002180000-0x000000000218C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/8-2-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/8-3-0x00000000021E0000-0x00000000021F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/8-6-0x00000000005D0000-0x00000000005DB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/8-7-0x0000000002180000-0x000000000218C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/8-8-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/8-9-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

    Download