Overview

overview

10

Static

static

3

JaffaCakes...3b.dll

windows7-x64

10

JaffaCakes...3b.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_e449e5e7e633dba72e1e3294737b29499b88ea1c1244e3914e59500b8b19843b

  • Size

    625KB

  • Sample

    241224-p5ln5axrhn

  • MD5

    33c00128208fa270017d787124cae498

  • SHA1

    e0ccd13ca646ed916eb1053b144d6bac16d75df4

  • SHA256

    e449e5e7e633dba72e1e3294737b29499b88ea1c1244e3914e59500b8b19843b

  • SHA512

    bb3ca42dc25495883e639d2688d0f931d50df8c86620ec5458214e8438628c283d930676c0135ec9ec3cc3ec20a4436f70dc1cb939d94c4abee82ac3c6cc2ae8

  • SSDEEP

    12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Z+U:+w1lEKOpuYxiwkkgjAN8Z9

Score
10/10
gozi999bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142
Attributes
  • base_path

    /phpadmin/

  • build

    250227

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      JaffaCakes118_e449e5e7e633dba72e1e3294737b29499b88ea1c1244e3914e59500b8b19843b

    • Size

      625KB

    • MD5

      33c00128208fa270017d787124cae498

    • SHA1

      e0ccd13ca646ed916eb1053b144d6bac16d75df4

    • SHA256

      e449e5e7e633dba72e1e3294737b29499b88ea1c1244e3914e59500b8b19843b

    • SHA512

      bb3ca42dc25495883e639d2688d0f931d50df8c86620ec5458214e8438628c283d930676c0135ec9ec3cc3ec20a4436f70dc1cb939d94c4abee82ac3c6cc2ae8

    • SSDEEP

      12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Z+U:+w1lEKOpuYxiwkkgjAN8Z9

    Score
    10/10
    gozi999bankerdiscoveryisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Gozi family

      gozi

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks