Overview

overview

10

Static

static

3

JaffaCakes...f0.dll

windows7-x64

10

JaffaCakes...f0.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_86d61aa4ed1d997bc054eba24fb08ea84d174174547f3fa0eac827e752c02ff0

  • Size

    626KB

  • Sample

    241224-2ne68szlfk

  • MD5

    9383eb5aff015ec459bc1dbe0ee225d3

  • SHA1

    b8d87586a86ff604027d1a981b9b3c83b139051f

  • SHA256

    86d61aa4ed1d997bc054eba24fb08ea84d174174547f3fa0eac827e752c02ff0

  • SHA512

    6dbe6ad2fbcc06790ca66bdd99b1a58cbe60f8ad4311db70f415e89eab08ddf0b12ed3d1cc89fb1096691f462562939fd80cea333329c21928ca3d1dedfc57fb

  • SSDEEP

    12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Z5j:+w1lEKOpuYxiwkkgjAN8Z5j

Score
10/10
gozi999bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142
Attributes
  • base_path

    /phpadmin/

  • build

    250227

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      JaffaCakes118_86d61aa4ed1d997bc054eba24fb08ea84d174174547f3fa0eac827e752c02ff0

    • Size

      626KB

    • MD5

      9383eb5aff015ec459bc1dbe0ee225d3

    • SHA1

      b8d87586a86ff604027d1a981b9b3c83b139051f

    • SHA256

      86d61aa4ed1d997bc054eba24fb08ea84d174174547f3fa0eac827e752c02ff0

    • SHA512

      6dbe6ad2fbcc06790ca66bdd99b1a58cbe60f8ad4311db70f415e89eab08ddf0b12ed3d1cc89fb1096691f462562939fd80cea333329c21928ca3d1dedfc57fb

    • SSDEEP

      12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Z5j:+w1lEKOpuYxiwkkgjAN8Z5j

    Score
    10/10
    gozi999bankerdiscoveryisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Gozi family

      gozi

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks