Overview

overview

10

Static

static

3

JaffaCakes...72.dll

windows7-x64

10

JaffaCakes...72.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_bd06ce1ec32a56662a99e3beb071634c5358b749b4acbb8f41ea04c0d4f51072

  • Size

    625KB

  • Sample

    241229-exf4kasmbx

  • MD5

    b279c7e714c429de885cc0a9d828d7ff

  • SHA1

    89aa97186fae9c63d9c1ce5252c895d16d1c5ec2

  • SHA256

    bd06ce1ec32a56662a99e3beb071634c5358b749b4acbb8f41ea04c0d4f51072

  • SHA512

    893a1b59755cb5929fea69b9dda7f5df57b37c7a6c8b4e20b846e77e4d3048a69eabaa6345530e0eb74ce1cb6a626aa057ce47f57a52b1916700e3594298fd46

  • SSDEEP

    12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZMe:+w1lEKOpuYxiwkkgjAN8ZF

Score
10/10
gozi999bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142
Attributes
  • base_path

    /phpadmin/

  • build

    250227

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      JaffaCakes118_bd06ce1ec32a56662a99e3beb071634c5358b749b4acbb8f41ea04c0d4f51072

    • Size

      625KB

    • MD5

      b279c7e714c429de885cc0a9d828d7ff

    • SHA1

      89aa97186fae9c63d9c1ce5252c895d16d1c5ec2

    • SHA256

      bd06ce1ec32a56662a99e3beb071634c5358b749b4acbb8f41ea04c0d4f51072

    • SHA512

      893a1b59755cb5929fea69b9dda7f5df57b37c7a6c8b4e20b846e77e4d3048a69eabaa6345530e0eb74ce1cb6a626aa057ce47f57a52b1916700e3594298fd46

    • SSDEEP

      12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZMe:+w1lEKOpuYxiwkkgjAN8ZF

    Score
    10/10
    gozi999bankerdiscoveryisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Gozi family

      gozi

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks