Overview

overview

10

Static

static

3

jaffacakes...lj.exe

windows10-2004-x64

10

jaffacakes...lj.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan-Spy.Win32.Ursnif.aglj.5e49b820ddba9e4df61b3b166a474163
  • Size 420KB
  • Sample261018-26ba1aat2k
  • SHA256 adb5aa933593cfe12d072bf96a8a9338a245a74610acec48c1f297625512a280
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
gozi5001adwarebankerdefense_evasiondiscoveryisfbpersistenceransomwarespywaretrojan

Malware Config

Extracted

Family

  • gozi

Botnet

  • 5001

C2

  • http://galiahtusfatolas.host

Attributes
  • build

    214061

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Extracted

Family

  • gozi

Attributes
  • build

    214061

Targets

    • Target
      jaffacakes118_Trojan-Spy.Win32.Ursnif.aglj.5e49b820ddba9e4df61b3b166a474163
    • Size 420KB
    • SHA256 adb5aa933593cfe12d072bf96a8a9338a245a74610acec48c1f297625512a280
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    adwarebanker5001defense_evasiondiscoverygoziisfbspywaretrojanpersistenceransomware

    • Family: Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks