Overview

overview

10

Static

static

3

jaffacakes...uc.exe

windows10-2004-x64

10

jaffacakes...uc.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan-Spy.Win32.Ursnif.aguc.9db2eea55cc382688478f245d25592d2
  • Size 333KB
  • Sample261018-26c5laat2m
  • SHA256 c5a28442d79638d139c8b1f353e1ccfd68897400ab7932d013d7b6984c617159
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
gozi2001adwarebankerdiscoveryisfbpersistenceransomwarespywaretrojan

Malware Config

Extracted

Family

  • gozi

Attributes
  • build

    214071

Extracted

Family

  • gozi

Botnet

  • 2001

C2

  • http://yyytttkkk.org

  • http://185.49.68.106

Attributes
  • build

    214071

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target
      jaffacakes118_Trojan-Spy.Win32.Ursnif.aguc.9db2eea55cc382688478f245d25592d2
    • Size 333KB
    • SHA256 c5a28442d79638d139c8b1f353e1ccfd68897400ab7932d013d7b6984c617159
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    adwarebanker2001discoverygoziisfbspywaretrojanpersistenceransomware

    • Family: Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks