Overview

overview

10

Static

static

10

JaffaCakes...f6.dll

windows7-x64

3

JaffaCakes...f6.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4a36881ed346ab1d00077ba4c2cc4f8ca3b6b7c3c8d070403bfc414b2c422bf6

  • Size

    43KB

  • MD5

    911289f9c871f9406faeafb5420039cb

  • SHA1

    97f3dbcadc1f50bd676a2672b5a4b1f324e1f00f

  • SHA256

    4a36881ed346ab1d00077ba4c2cc4f8ca3b6b7c3c8d070403bfc414b2c422bf6

  • SHA512

    959c22dfd13319004f336f89fd16d5ae1c851eea5ccbde2f62f4bd2084925db361f44370e7d3b3753cd97dd7d48013989158905145347493c5a210821949579a

  • SSDEEP

    768:5sLkvkJb1J1up9RNdOuZtxE5WkXQDrT+mgazC434i3z93teyS7sOMImb:uLksJbLQ/aWkXQDrTfBzC434Sz9PS7sV

Score
10/10
isfb3000gozi

Malware Config

Extracted

Family

gozi

Botnet

3000

C2

config.edge.skype.com

185.154.53.214

185.154.53.188

46.30.42.246
Attributes
  • base_path

    /drew/

  • build

    260226

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_4a36881ed346ab1d00077ba4c2cc4f8ca3b6b7c3c8d070403bfc414b2c422bf6
    .dll windows:5 windows x86 arch:x86

    11e4a06aed8466f4a1d1b855f6202f8f


    Headers

    Imports

    Sections