General

  • Target

    JaffaCakes118_3f19922401c1c6c8ee62a059df83752a1279a394641186a834327119c6f3b72e

  • Size

    625KB

  • Sample

    241222-y8wsyaxqhy

  • MD5

    1563614c712b92e6d391f5a1b1be69f4

  • SHA1

    c09c6942d2c1bc34f8a2f577a10a1209777de7ab

  • SHA256

    3f19922401c1c6c8ee62a059df83752a1279a394641186a834327119c6f3b72e

  • SHA512

    509f571cfa81ec60d475cf9948772d846eca0f273cbe1317587f9b06919822ed30ec2d770160ecc1ab04f0878eafc66699b01cf10e11b86bb6606d5b71189099

  • SSDEEP

    12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZZ:+w1lEKOpuYxiwkkgjAN8ZZ

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142

Attributes
  • base_path

    /phpadmin/

  • build

    250227

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIdG2NVRT4bIwAE0zLT2DTbLDZ
3
979eMzKPtARqeuvDBcFf2A+4K8FvGS1r/gid2qMVfP9RlPEOv2lwbiYN49dYO+Qr
4
8W9jU/t6qakm8l85c780VPQBjhOUrKpM+044k5wroz4Vu5OjfJF3j4SRrbe6ea/0
5
sHXQ+NV6gNEXzbTyDwIDAQAB
6
-----END PUBLIC KEY-----
aes.plain
1
1f4DxymshQl48FMz

Targets

    • Target

      JaffaCakes118_3f19922401c1c6c8ee62a059df83752a1279a394641186a834327119c6f3b72e

    • Size

      625KB

    • MD5

      1563614c712b92e6d391f5a1b1be69f4

    • SHA1

      c09c6942d2c1bc34f8a2f577a10a1209777de7ab

    • SHA256

      3f19922401c1c6c8ee62a059df83752a1279a394641186a834327119c6f3b72e

    • SHA512

      509f571cfa81ec60d475cf9948772d846eca0f273cbe1317587f9b06919822ed30ec2d770160ecc1ab04f0878eafc66699b01cf10e11b86bb6606d5b71189099

    • SSDEEP

      12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZZ:+w1lEKOpuYxiwkkgjAN8ZZ

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Gozi family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.