Overview

overview

10

Static

static

3

jaffacakes...eu.exe

windows10-2004-x64

10

jaffacakes...eu.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan-Spy.Win32.Zbot.yteu.c0cab7348e8e01510b930e8a9ce105c1
  • Size 482KB
  • Sample261016-dkrh4awtes
  • SHA256 d231bc7187252a557d74954f1d6a0f77172121d80edbb0a2ef20e9dfdbda93a1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
gozi1100bankerdefense_evasiondiscoveryexecutionisfbpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

  • gozi

Extracted

Family

  • gozi

Botnet

  • 1100

C2

  • boombom.at/krp3cmg

  • hipohook.cn/krp3cmg

  • gumerhot.at/krp3cmg

  • voligon.cn/krp3cmg

  • joolpok.at/krp3cmg

  • nomopef.su/krp3cmg

  • xiloker.cn/krp3cmg

  • quihot.at/krp3cmg

  • joombok.su/krp3cmg

  • ribomoon.cn/krp3cmg

  • quartan.su/krp3cmg

  • chikoole.cn/krp3cmg

Attributes
  • build

    214845

  • exe_type

    worker

  • server_id

    110

rsa_pubkey.plain
serpent.plain

Targets

    • Target
      jaffacakes118_Trojan-Spy.Win32.Zbot.yteu.c0cab7348e8e01510b930e8a9ce105c1
    • Size 482KB
    • SHA256 d231bc7187252a557d74954f1d6a0f77172121d80edbb0a2ef20e9dfdbda93a1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    banker1100defense_evasiondiscoveryexecutiongoziisfbpersistenceprivilege_escalationtrojan

    • Family: Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

      defense_evasion

    • Executes dropped EXE

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks