Overview

overview

10

Static

static

10

JaffaCakes...b8.dll

windows7-x64

3

JaffaCakes...b8.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_d16191047b6c5690d518ee74df53d731747cac682283b76a6c4e941034d60ab8

  • Size

    56KB

  • Sample

    241222-w6zeyavpax

  • MD5

    1bc0a71858c5759193c3b249c4f2794b

  • SHA1

    f3d9590788920c4f413b827548c986f55ba32405

  • SHA256

    d16191047b6c5690d518ee74df53d731747cac682283b76a6c4e941034d60ab8

  • SHA512

    0bbe6aa6a9c9065d4b412463f9ab0ec37cea785f389956c4845561d0fef54146a384f34991e8509a26834490d8dd75cea9f02aca49d69d9f4cde4305fe2cd95a

  • SSDEEP

    768:fgsMtLUMJyqKTHv/2HvCLt2KVLyWBpOSyDkrAIO/B02m4V:fgsIFUqKyPCLwUppaDEAZB0G

Score
10/10
gozi7624discoveryisfb

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7624

C2

atmospheri.top

linkspremium.ru

premiumlists.ru
Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      JaffaCakes118_d16191047b6c5690d518ee74df53d731747cac682283b76a6c4e941034d60ab8

    • Size

      56KB

    • MD5

      1bc0a71858c5759193c3b249c4f2794b

    • SHA1

      f3d9590788920c4f413b827548c986f55ba32405

    • SHA256

      d16191047b6c5690d518ee74df53d731747cac682283b76a6c4e941034d60ab8

    • SHA512

      0bbe6aa6a9c9065d4b412463f9ab0ec37cea785f389956c4845561d0fef54146a384f34991e8509a26834490d8dd75cea9f02aca49d69d9f4cde4305fe2cd95a

    • SSDEEP

      768:fgsMtLUMJyqKTHv/2HvCLt2KVLyWBpOSyDkrAIO/B02m4V:fgsIFUqKyPCLwUppaDEAZB0G

    Score
    3/10
    discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks