gozi | 2e59ddf2b3e768eb00855b1d0dcb582539cfc9293f2e98c8a89251f75d37fc1e | Triage

Sharing

General

Target

JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6
Size

32KB
Sample

250313-ldgdjssvcx
MD5

6ff88b3a8c49d3dc410c43abcf46e3c6
SHA1

7f543edab67949481508589d7d0100b9355e4658
SHA256

2e59ddf2b3e768eb00855b1d0dcb582539cfc9293f2e98c8a89251f75d37fc1e
SHA512

5d7b14c56ea2c54adf7681eaff372eecc50244dbbbeca554ea1ce7b09dcc82f4f74cb6fa63fee201b7b9a09289acb55f388e3e01b958503823da69e20b3e54ac
SSDEEP

768:fQMt97o9Uef8q2/0GU/Fq37w1aJmOWjQz9ZXWJjkJXo/5:J989UGm8GUELw16cJjkJs

Score

10^/10

gozi discovery isfb persistence

Malware Config

Extracted

Family

gozi

Targets

- Target
  
  JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6
- Size
  
  32KB
- MD5
  
  6ff88b3a8c49d3dc410c43abcf46e3c6
- SHA1
  
  7f543edab67949481508589d7d0100b9355e4658
- SHA256
  
  2e59ddf2b3e768eb00855b1d0dcb582539cfc9293f2e98c8a89251f75d37fc1e
- SHA512
  
  5d7b14c56ea2c54adf7681eaff372eecc50244dbbbeca554ea1ce7b09dcc82f4f74cb6fa63fee201b7b9a09289acb55f388e3e01b958503823da69e20b3e54ac
- SSDEEP
  
  768:fQMt97o9Uef8q2/0GU/Fq37w1aJmOWjQz9ZXWJjkJXo/5:J989UGm8GUELw16cJjkJs
Score

8^/10

discovery persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence