General

  • Target

    JaffaCakes118_86e072dd712b160d39a7196822a1a2c1827993236f92cd185a415ad04929e831

  • Size

    625KB

  • Sample

    241222-mh61favmem

  • MD5

    b8beffa14f03cfe58f3e5145d66368ef

  • SHA1

    9da6b3bfdd91c3376b6fe0f50513a8af45b109ec

  • SHA256

    86e072dd712b160d39a7196822a1a2c1827993236f92cd185a415ad04929e831

  • SHA512

    3edc40652f9cc8f76dfc4ab81f3f3fa4020642a06a812113a574c81afa5281a0e716d3cb697842cd0b28ce06ecb439015a8dd90f8581b4db585cf91af40751a4

  • SSDEEP

    12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZmW:+w1lEKOpuYxiwkkgjAN8ZmW

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142

Attributes
  • base_path

    /phpadmin/

  • build

    250227

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIdG2NVRT4bIwAE0zLT2DTbLDZ
3
979eMzKPtARqeuvDBcFf2A+4K8FvGS1r/gid2qMVfP9RlPEOv2lwbiYN49dYO+Qr
4
8W9jU/t6qakm8l85c780VPQBjhOUrKpM+044k5wroz4Vu5OjfJF3j4SRrbe6ea/0
5
sHXQ+NV6gNEXzbTyDwIDAQAB
6
-----END PUBLIC KEY-----
aes.plain
1
1f4DxymshQl48FMz

Targets

    • Target

      JaffaCakes118_86e072dd712b160d39a7196822a1a2c1827993236f92cd185a415ad04929e831

    • Size

      625KB

    • MD5

      b8beffa14f03cfe58f3e5145d66368ef

    • SHA1

      9da6b3bfdd91c3376b6fe0f50513a8af45b109ec

    • SHA256

      86e072dd712b160d39a7196822a1a2c1827993236f92cd185a415ad04929e831

    • SHA512

      3edc40652f9cc8f76dfc4ab81f3f3fa4020642a06a812113a574c81afa5281a0e716d3cb697842cd0b28ce06ecb439015a8dd90f8581b4db585cf91af40751a4

    • SSDEEP

      12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZmW:+w1lEKOpuYxiwkkgjAN8ZmW

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Gozi family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.