Overview

overview

10

Static

static

10

JaffaCakes...30.dll

windows7-x64

3

JaffaCakes...30.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_fa13e39768fdfb72af2fe96aed08adb191b925de09013702e364909e29167a30

  • Size

    174KB

  • MD5

    1f683d3624c3f5144c14a2108d29f982

  • SHA1

    7c2d1e61481d122cc7f48535c79832fd961fd27f

  • SHA256

    fa13e39768fdfb72af2fe96aed08adb191b925de09013702e364909e29167a30

  • SHA512

    d633e2f543326a46f23e905a757f83a69f0d855e0139b6d28f013440fd4e8339346f49fb6befc775a9ecc391423b1b10c053e6407f5964ff4faa0ca36306ba19

  • SSDEEP

    3072:lI71dnLPQppM/B/W/POXMb2qlalj/FYAe/j7Ajis5t8ZS7UeaOsNsRgC7cP2favu:YVPqMY/POX3qlalpYAUQeW8feasRdc2B

Score
10/10
isfb4483gozi

Malware Config

Extracted

Family

gozi

Botnet

4483

C2

lycos.com

mail.yahoo.com

37.120.222.107

185.186.247.91

185.186.245.171

dumokurenu.xyz

fumokurenu.xyz

lumokurenu.xyz
Attributes
  • base_path

    /images/

  • build

    250211

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    worker

  • extension

    .avi

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_fa13e39768fdfb72af2fe96aed08adb191b925de09013702e364909e29167a30
    .dll windows:5 windows x86 arch:x86

    3e5a5960a954602a0f374a91077473ac


    Headers

    Imports

    Sections