Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

loader_260...71.dll

windows7-x64

3

loader_260...71.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4f0066b3a94a37a1bb9f13d4ad953b45b761635c0dac4418a8524deffa4c2bc0

  • Size

    38KB

  • MD5

    aa7b507a69f9a65fc211cf821bfbbfb2

  • SHA1

    7dd8992663f8eb289eaaedbb52ce37cedc48106b

  • SHA256

    4f0066b3a94a37a1bb9f13d4ad953b45b761635c0dac4418a8524deffa4c2bc0

  • SHA512

    caf220a957e852e60aec5820ca9cf3c3ae509605ec269f300dd06766000ae84bd4ec215c0921b099ea4ef485e2859d71daa40070d5c6471d21edb8021b28be10

  • SSDEEP

    768:v6CNzUJvaQjxB72WPyBga0V59dcL7JFWGXKeYRzkcoyUeSzXd6IXB8H:v6SzGvaQjxcxgaUpcxFWGKedcoyUeqXa

Score
10/10
isfb8899gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

8899

C2

msn.com/login

vloderuniok.website

gloderuniok.website
Attributes
  • base_path

    /jkloio/

  • build

    260212

  • dga_season

    10

  • exe_type

    loader

  • extension

    .lko

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_4f0066b3a94a37a1bb9f13d4ad953b45b761635c0dac4418a8524deffa4c2bc0
    .zip

    Password: infected

  • loader_260212_3ce9df2272bb98916f215be5a0943ed0fc06f72eca3bed2385aacc7c1b4c6071
    .dll regsvr32 windows:5 windows x86 arch:x86

    7810ad7e9f1684556ca41a69627e4ce9


    Headers

    Imports

    Exports

    Sections