gozi

General

Target

JaffaCakes118_8f0015f6e7c728d7f00ea4756f3964b291f13e3501e623c73933449e272cbb1a
Size

625KB
Sample

241224-1mmz1syjex
MD5

7af66d2232a409b7ba67e91b3251fabe
SHA1

fd727a72cc329375fdecc74361d3cea5a5cb056d
SHA256

8f0015f6e7c728d7f00ea4756f3964b291f13e3501e623c73933449e272cbb1a
SHA512

1bcee78cb6470bf94e182ccae9ea5cd5912d818f4aa66e1622a4019bb9ebacc1c7dc2cebc2b4f67d490f0e9b7564b87d8629a0cb443b3df0bd5eb3a301400771
SSDEEP

12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Zn:+w1lEKOpuYxiwkkgjAN8Zn

Score

10^/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142

Attributes

base_path
/phpadmin/
build
250227
exe_type
loader
extension
.src
server_id
50

rsa_pubkey.plain

1
-----BEGIN PUBLIC KEY-----
2
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIdG2NVRT4bIwAE0zLT2DTbLDZ
3
979eMzKPtARqeuvDBcFf2A+4K8FvGS1r/gid2qMVfP9RlPEOv2lwbiYN49dYO+Qr
4
8W9jU/t6qakm8l85c780VPQBjhOUrKpM+044k5wroz4Vu5OjfJF3j4SRrbe6ea/0
5
sHXQ+NV6gNEXzbTyDwIDAQAB
6
-----END PUBLIC KEY-----

aes.plain

1
1f4DxymshQl48FMz

Targets

- Target
  
  JaffaCakes118_8f0015f6e7c728d7f00ea4756f3964b291f13e3501e623c73933449e272cbb1a
- Size
  
  625KB
- MD5
  
  7af66d2232a409b7ba67e91b3251fabe
- SHA1
  
  fd727a72cc329375fdecc74361d3cea5a5cb056d
- SHA256
  
  8f0015f6e7c728d7f00ea4756f3964b291f13e3501e623c73933449e272cbb1a
- SHA512
  
  1bcee78cb6470bf94e182ccae9ea5cd5912d818f4aa66e1622a4019bb9ebacc1c7dc2cebc2b4f67d490f0e9b7564b87d8629a0cb443b3df0bd5eb3a301400771
- SSDEEP
  
  12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Zn:+w1lEKOpuYxiwkkgjAN8Zn
Score

10^/10

gozi 999 banker discovery isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Gozi family
  gozi
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Gozi family

Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.