Overview

overview

10

Static

static

10

JaffaCakes...b8.dll

windows7-x64

3

JaffaCakes...b8.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_d16191047b6c5690d518ee74df53d731747cac682283b76a6c4e941034d60ab8

  • Size

    56KB

  • MD5

    1bc0a71858c5759193c3b249c4f2794b

  • SHA1

    f3d9590788920c4f413b827548c986f55ba32405

  • SHA256

    d16191047b6c5690d518ee74df53d731747cac682283b76a6c4e941034d60ab8

  • SHA512

    0bbe6aa6a9c9065d4b412463f9ab0ec37cea785f389956c4845561d0fef54146a384f34991e8509a26834490d8dd75cea9f02aca49d69d9f4cde4305fe2cd95a

  • SSDEEP

    768:fgsMtLUMJyqKTHv/2HvCLt2KVLyWBpOSyDkrAIO/B02m4V:fgsIFUqKyPCLwUppaDEAZB0G

Score
10/10
isfb7624gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7624

C2

atmospheri.top

linkspremium.ru

premiumlists.ru
Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_d16191047b6c5690d518ee74df53d731747cac682283b76a6c4e941034d60ab8
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections