General
-
Target
JaffaCakes118_db9700d5fd7f87c18d639c64b25cb485f3c4a0e69c6fe10e10637a295986078f
-
Size
54KB
-
MD5
cdcf0ed72b9e49694450692b4684c0cd
-
SHA1
54c2f26e6ba01dcfc56e2c4245aec9115827f0ce
-
SHA256
db9700d5fd7f87c18d639c64b25cb485f3c4a0e69c6fe10e10637a295986078f
-
SHA512
b8dd539547e4976f39ad179d972fad442c3d2b28a9c55dafcfe58d373e468e0beb83da7bc3b8b1baa56116540e4a6c48c73bfc23a8ca4e73f0137ce356ad6f6d
-
SSDEEP
1536:c+0Ka1pO2qMkI2qlalXGVco5Qc1yy3WRzd0Mq2:5Ja13qMP2qlalW+o5ngB0Mq2
Score
10/10
Malware Config
Extracted
Family
gozi
Botnet
8899
C2
msn.com/login
vloderuniok.website
gloderuniok.website
Attributes
-
base_path
/jkloio/
-
build
260212
-
dga_season
10
-
exe_type
loader
-
extension
.lko
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
JaffaCakes118_db9700d5fd7f87c18d639c64b25cb485f3c4a0e69c6fe10e10637a295986078f
b71ee1411bfd8eb1c7728a9977b3e7f4
Headers
Imports
Sections