Overview

overview

10

Static

static

3

5e7740afdd...57.exe

windows7-x64

10

5e7740afdd...57.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_154fcf6de1a4d2148da99d796d7c611b10d894546610561b588a970ab7c7053f

  • Size

    135KB

  • Sample

    241224-pvmtfaxmex

  • MD5

    7f5f7a43ba27f8825f6744559169f113

  • SHA1

    b8dae9800fbde147c9705377670897e806c6abdb

  • SHA256

    154fcf6de1a4d2148da99d796d7c611b10d894546610561b588a970ab7c7053f

  • SHA512

    1ec967ad2db08d47ed43d299fed52abd9696f045c13a7e92e5911ae5c1b281b49803e7e75d272515fc2c67aafc5525f477aa82fbf26a3caeb16b3c3bab7e8990

  • SSDEEP

    3072:kmzk6rktZsru/oQ3nLNxtNr3EVoLztB79x+4yVthD:kv6rTGo2Ljr3EVOtBe4yVrD

Score
10/10
gozi3400bankerdiscoveryisfbphishingtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    214082

Extracted

Family

gozi

Botnet

3400

C2

microsoft.com

update.microsoft.com

avast.com

tm90daron.club

jamericohermann.com

b9437ariane.com
Attributes
  • build

    214082

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      5e7740afdd5c5865a2304e2f7c5fc3f1cd1016f503a4b1752923f44059fd1a57

    • Size

      208KB

    • MD5

      35e3868c7d28d2ed87248077f670c707

    • SHA1

      8e54a89fc59683cee86de964ec475dea9fc5618b

    • SHA256

      5e7740afdd5c5865a2304e2f7c5fc3f1cd1016f503a4b1752923f44059fd1a57

    • SHA512

      c8bbf7d192aff6c45005700014a22ea72832febc73b16ae925b339a356815b27bea3252917a9aa94e48fc05377b85bd1206f33c7e46fb17bdf325aff7ef40e37

    • SSDEEP

      6144:mG5SEzzbTFGB7JPZc+mCZzw0SdBPs6nVC:dvPKBsC5wFBPs4V

    Score
    10/10
    gozi3400bankerdiscoveryisfbtrojanphishing

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Gozi family

      gozi

    • A potential corporate email address has been identified in the URL: 67C716D751E567F70A490D4C@AdobeOrg

      phishing
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks