Overview

overview

10

Static

static

10

29886509fe...1f.dll

windows7-x64

3

29886509fe...1f.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_f42512a61e57afecc9aa65dd1359d9a87fcd1619fb5df6eb0bca208fcfb9973a

  • Size

    38KB

  • MD5

    d70a86eab8b4d9a760ca72e12d032f32

  • SHA1

    22f91652014c97569a3ff9fe9bc87fe262bd5041

  • SHA256

    f42512a61e57afecc9aa65dd1359d9a87fcd1619fb5df6eb0bca208fcfb9973a

  • SHA512

    2ef81d1a9cc75235ebd101c1481ec58508c86900d0edf13b0f79ea0c381ec9259e7c081c411c74e6466e2bf4fbb63a42b1dde8aed635fde382bbdfd759973df2

  • SSDEEP

    768:sTH7lehe1iZfyVkRYgPYcMFxKWf84rNR933jMwuS789rW5It:sTH7lehjqSYF5KtEH9b789rcIt

Score
10/10
isfb7406gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7406

C2

signin.microsoft.com

login.microsoft.com

keeneticline.com

keeneticline.bar

infmeetic.co
Attributes
  • base_path

    /includes/

  • build

    250193

  • dns_servers

    107.174.86.134

    107.175.127.22

  • exe_type

    loader

  • extension

    .img

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_f42512a61e57afecc9aa65dd1359d9a87fcd1619fb5df6eb0bca208fcfb9973a
    .zip

    Password: infected

  • 29886509fe1c9628fa5227a052e98e5b7cd7bc04cab15f498eb884d588654b1f.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    9b4bd5e9c744a772e2cae4b95c84d26f


    Headers

    Imports

    Exports

    Sections