gozi

General

Target

JaffaCakes118_5ac728f6c67919fa184df9076a35022151caa37f6206f06035ab3b5d73c5d12c
Size

134KB
Sample

241224-ngaraawpck
MD5

c153de8e7e953351560d4a95e87c8e7b
SHA1

61d5ca7cbe38d4268ea313196ae0f34857d2ca72
SHA256

5ac728f6c67919fa184df9076a35022151caa37f6206f06035ab3b5d73c5d12c
SHA512

19cb4eeaa6d3bc50583d71d7fc640a33c342960fa0bfa8f3610d23ba80da79bc1c4a067d1a32e596ec333fb4f1a3ed3ffd841ecbd5f83c864a08b0e53832540f
SSDEEP

3072:ym1m9wGdgxTiI0s1HZV8JK//hTtXdKPT1juxn/l6zsy2EDo3k:ySm9wKI0sf+JK/dtXdKLluxNCsdGx

Score

10^/10

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7251

C2

web.vortex.data.microsoft.com

ocsp.sca1b.amazontrust.com

nerowins.com

Attributes

build
250177
dns_servers
107.174.86.134

107.175.127.22
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  8df914f790a6e5eb07042cce36ea9a23e23cdc1610d930f306f9ef55b6d8a2c5.exe
- Size
  
  286KB
- MD5
  
  9df5fcca1aadec6333301aca7a13c481
- SHA1
  
  f3445c636e0a702eff7782b9e8eeb4ca84f842ff
- SHA256
  
  8df914f790a6e5eb07042cce36ea9a23e23cdc1610d930f306f9ef55b6d8a2c5
- SHA512
  
  c1bb8d9ce6f014cc6c1dd68e767c03bbc4d56875f792d2f994f5740ad2d23ab75d3caa9b9d9778fab903685db4f87c1b999756e5b3a971dec1a405cad5ac17ad
- SSDEEP
  
  6144:SExImdn3y5LQv+0az3d1jDbj950ylG+OhZHoTV43:SExTn34Qv+rz3/jDbj950ylG+AZH+V43
Score

10^/10

gozi 7251 banker discovery isfb trojan
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Gozi family
  gozi
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Gozi family

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2