Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_0743e3e2000610d12ea06f2291b53b0973c3dd4c8a355c1599d936d963d27fcf

  • Size

    625KB

  • Sample

    241224-dgy4rszrdl

  • MD5

    46812b1cf995cfd0c92b45571286bfcb

  • SHA1

    6728f787764bab375014d2c0879619cbbe8d9825

  • SHA256

    0743e3e2000610d12ea06f2291b53b0973c3dd4c8a355c1599d936d963d27fcf

  • SHA512

    360030dce46bf5b57b682900c7bcd3fd17d91131dce73c345d0e011df9948f52fff122ecff143c2bfd620ce615abc79bf0267b29692400105aedd68299e56997

  • SSDEEP

    12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Z6:+w1lEKOpuYxiwkkgjAN8Z6

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142

Attributes
  • base_path

    /phpadmin/

  • build

    250227

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIdG2NVRT4bIwAE0zLT2DTbLDZ
3
979eMzKPtARqeuvDBcFf2A+4K8FvGS1r/gid2qMVfP9RlPEOv2lwbiYN49dYO+Qr
4
8W9jU/t6qakm8l85c780VPQBjhOUrKpM+044k5wroz4Vu5OjfJF3j4SRrbe6ea/0
5
sHXQ+NV6gNEXzbTyDwIDAQAB
6
-----END PUBLIC KEY-----
aes.plain
1
1f4DxymshQl48FMz

Targets

    • Target

      JaffaCakes118_0743e3e2000610d12ea06f2291b53b0973c3dd4c8a355c1599d936d963d27fcf

    • Size

      625KB

    • MD5

      46812b1cf995cfd0c92b45571286bfcb

    • SHA1

      6728f787764bab375014d2c0879619cbbe8d9825

    • SHA256

      0743e3e2000610d12ea06f2291b53b0973c3dd4c8a355c1599d936d963d27fcf

    • SHA512

      360030dce46bf5b57b682900c7bcd3fd17d91131dce73c345d0e011df9948f52fff122ecff143c2bfd620ce615abc79bf0267b29692400105aedd68299e56997

    • SSDEEP

      12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Z6:+w1lEKOpuYxiwkkgjAN8Z6

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Gozi family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.