gozi

General

Target

JaffaCakes118_fd65bb77bed136b09207cdc7bea28c0d4915e439a6722be75eb858aa9338d131
Size

372KB
Sample

241222-j2gm4szqax
MD5

eaa0b683f58d97d89c2dd3154a087879
SHA1

070c9f4596f3c9a377e3d75b5d1011efc5f8de4a
SHA256

fd65bb77bed136b09207cdc7bea28c0d4915e439a6722be75eb858aa9338d131
SHA512

d8cdb2e8c25d8c2584f19f469b1782d173c99e83f2b83068f7e61a3a78c9c92499a5f0550ac81b23c46cea2ea5ee98333d7df61c71f1f9c4886cfa367756d3a6
SSDEEP

6144:NbP57UDV0iDt00NKwwmFxDa9oNiEZ/LbseQB7G9wRENL:NbsV5t0ikgDa9oNiEZ/LbFQmrL

Score

10^/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

8877

C2

ocsp.digicert.com

aus5.mozilla.org

palominoloopus.website

dresdengrauwes.website

Attributes

base_path
/hleedol/
build
250187
dga_season
10
exe_type
loader
extension
.lua
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  JaffaCakes118_fd65bb77bed136b09207cdc7bea28c0d4915e439a6722be75eb858aa9338d131
- Size
  
  372KB
- MD5
  
  eaa0b683f58d97d89c2dd3154a087879
- SHA1
  
  070c9f4596f3c9a377e3d75b5d1011efc5f8de4a
- SHA256
  
  fd65bb77bed136b09207cdc7bea28c0d4915e439a6722be75eb858aa9338d131
- SHA512
  
  d8cdb2e8c25d8c2584f19f469b1782d173c99e83f2b83068f7e61a3a78c9c92499a5f0550ac81b23c46cea2ea5ee98333d7df61c71f1f9c4886cfa367756d3a6
- SSDEEP
  
  6144:NbP57UDV0iDt00NKwwmFxDa9oNiEZ/LbseQB7G9wRENL:NbsV5t0ikgDa9oNiEZ/LbFQmrL
Score

10^/10

gozi 8877 banker discovery isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Gozi family
  gozi
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Gozi family

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2