�4*$D��5�����~�L� ��W3k���Mm*�;���=�X�P]��oU�RK"���Xd�F���y)�n�Rj�a�L����@T��v�|?�+qО?�9�:L? ����14JB��p.�j�V�R(8��4�;�����<��m�#�m֙o�A�� �z}�2EHȽ�r@ed�˫d#�>�K��~=�����~e�j7:*����-`Υ��2�^�W��*��������6�*̥.�sg�O��G��c��x^g2!���}��B �� A87|eG���L�L<۬v? �T�${Dg~~0Q�G��?�� Z] �������*����)���|��|��D��;j�) M@*J�K�Y�f�r�U�ʿ���k��I�s�����h �c��Tj�ج�9��7���:Md�yr?c��Q������܋��O]��oNb�������L[qjz����8����N�ʰ��{Z�jI&%3�9��y! *�s�H4�lz6�3N}�0\2h���`�n�aM�wK�N�!���A��v)m���sM6^���´���2!�ww�ө�?8 f ����Z� ��C��s�\�� �u�L�����b�eQG��������V������Ly6���@fș(����� �'ۡ)��^��_A��z~�r���"��zk_�BG���?#m� C?+S��#����p�i����Z��[�6�ᐆ3����و��Z����>:Jk��c5�]�j����}�GV��3�=�ϟ����jo!�T7'��caŐ�q���g�dq������qD��_��1u���̻�SځUo�s ��,@�${r��` "�����u��2��P.��7A�&� ��Ҡ�� i��DP:r�7}=��;C�W��IXuQ!��L����=�� x�W��D�Dw�sTlU8�����o�r���ɺ�|���{�G^amu��9��v�J�%̒B��`�j�[l6L?ۣ78J�{��Qw���{o`�m��&���D\��p����t:�i�)�������l�پ�$�ƾ@���L2�CԭӈN�}���3��x���W4L���ڐ���iM.%g�R��n-�|ﰖ�1D���Qo��W5���P���2Xa3;DD�.�%IA��)&��)��fu��m����UX�� I&��C'�����M���ڝ��J�D [BE(G/�7W #wp7[N"QLj�^n�������cd c������aߤ�,-����$�JSeN�I�S�%�!�Q.��#wh���Lp������16*_�g���maxE�SGyz�n�XE����B�彔�thO2��d����� �����&KR��V))��+�k�����x�^G4ʐM(q��n"|����)c��֗��\���v<Ҙ%�#��UU8�v������2��-����u���\�=w���q4���v���c�k�h*���@���-��;�>�AmY�>`V<�18`0��`l��!��o�QE��e��nZ�9ّ1q0*,a��Y���!�b�{hϲ����5�t������+pb��nj��㜸�K�_ٸ�w,���$IW��5wˬ�饑@�Hʡ��%���v2>�q�l�9;����J����!��N+ь�� �3:4΄ǵˌ����Q>�sj�3�:5Wq6��r��g�q�Q��À�p�"�Y�W�{�P�����l$�3�H �e�缷�c�ܕ���Y�I����1�5���������O�`{o�0���~N���"�IO��>����;-�G���a2�_nY�U�����A�qb����J|j��j�,}�?@�LTx�mfeh4�:��X�3Z����7�����~�f �Lo@���3�:<���C К�5fA�\���o����:�9f�+� ��`u���p�7����Ū}è.(�Ϡ�~,c� �;�e`s�Ka��SD�p����D��h�^���T��7�;Q�kf+��/u"�qni}_��]ԣ�������%Z=�upk��?v���Ё7��Έ���_��j������&�99�r6��>�$���|J�\�.�+��S���v{H��:���� �zw8�lwO.(����<ָ�5���V�2�b���"A!_K��{R�sk2��>��Tk� �+�s�Vu�K`��W R'\�:wԇ+q3{�~�Zin�+�EX8d�V`A� C��.w;䞽�5����|�%�/�`�H~^��{Po�Yj��>�߉ ;ن /#Yi1�:5,5*E���?�-�r�݀B��m{�d�%� ��.�d|�,L�)�I��8߾���[�]'�숁(�4ĤƇ@��R9?Sa_so�d\���D��8�� ��/�/L�*�[�;m�� nD@t�^�@��u �K�,�"����e������z����u�������sݒ#�S���D5x-��,����-��4jO�@f���?p oG���o�"�T s����o;������O��g���1��E_���-i2�=��n�����|a�PD#�7��� ��D?�B������zr|�ڱ"���h�D�M��-r;U�{iE��B��%U��G��,�v��vF��3��80�WI�_ẓ������8���,�g1���t�`��-pZ�ag>w�N0Z����`�s�Iud�'Sl���1�%q��t�k�L���^C�=m�$ ,�V�ͥX��[j�2�'bb�A���z�} FPQ�^j�6ͱ�7A����$icSz1��$e�.nBay@���nj���Ġ�D^Ƀ�U�����/�"�ޒ����8KK��!��+�c{r��Q&��y�K�|�ρR�ik~i-��5��g]�:����u�VȽ�U$����k{e�64��4eM�B3��Ví� <�ޢ���}>kR�;����P���K�|=u;�#5U�!3<3���8�5�P߰��)͢5���K�(m���}��܇��vX33x;罱 �:(��4�+�n�����^�w��c��U@�/�c�`bvU�bT$�$-�aJV^�|����xG$W����y�|�7�7t����#�"멾t��6b:ך�S��]��n�x?���e���G5'X
Overview
overview
10Static
static
100f56c5738a...f08901
linux_amd64
0f56c5738a...f08901
linux_mipsel
0f56c5738a...f08901
linux_mips
219156c025...f0.exe
windows7_x64
10219156c025...f0.exe
windows10_x64
102a0f53dd66...03.exe
windows7_x64
102a0f53dd66...03.exe
windows10_x64
1036ef5e0db1...a0.exe
windows7_x64
1036ef5e0db1...a0.exe
windows10_x64
104072fc745a...65.exe
windows7_x64
104072fc745a...65.exe
windows10_x64
1042c8ded976...95.exe
windows7_x64
1042c8ded976...95.exe
windows10_x64
1052969fae09...5d.rtf
windows7_x64
1052969fae09...5d.rtf
windows10_x64
10571de4698e...31.exe
windows7_x64
10571de4698e...31.exe
windows10_x64
1057bb59a2c4...52.rtf
windows7_x64
1057bb59a2c4...52.rtf
windows10_x64
10662fbe23c8...0a.exe
windows7_x64
10662fbe23c8...0a.exe
windows10_x64
1070d5a71e82...91.dll
windows7_x64
170d5a71e82...91.dll
windows10_x64
171d384c258...86.exe
windows7_x64
1071d384c258...86.exe
windows10_x64
1079745c2263...9d.exe
windows7_x64
1079745c2263...9d.exe
windows10_x64
1083c46c1972...c3.exe
windows7_x64
1083c46c1972...c3.exe
windows10_x64
108cecb6b01a...d0.exe
windows7_x64
108cecb6b01a...d0.exe
windows10_x64
10a3feb5265e...66.exe
windows7_x64
10Behavioral task
behavioral1
Sample
0f56c5738ae435abeac7a0928a5de2ff5d4082370c43f257a4c0589212f08901
Resource
ubuntu-amd64
Behavioral task
behavioral2
Sample
0f56c5738ae435abeac7a0928a5de2ff5d4082370c43f257a4c0589212f08901
Resource
debian9-mipsel
Behavioral task
behavioral3
Sample
0f56c5738ae435abeac7a0928a5de2ff5d4082370c43f257a4c0589212f08901
Resource
debian9-mipsbe
Behavioral task
behavioral4
Sample
219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe
Resource
win7v20210408
Behavioral task
behavioral5
Sample
219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
2a0f53dd66eff57c82fcad2fff75d7ac63f6f4d764ec27fe862e6b3f01a21c03.exe
Resource
win7v20210410
Behavioral task
behavioral7
Sample
2a0f53dd66eff57c82fcad2fff75d7ac63f6f4d764ec27fe862e6b3f01a21c03.exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
36ef5e0db18469267810503ba4fd099e59007c3f10f718bccffdc93e87a853a0.exe
Resource
win7v20210408
Behavioral task
behavioral9
Sample
36ef5e0db18469267810503ba4fd099e59007c3f10f718bccffdc93e87a853a0.exe
Resource
win10v20210410
Behavioral task
behavioral10
Sample
4072fc745ae1b976bfff8fdfdebdac6db5e33bb4f63507b4d56ab67b98c6db65.exe
Resource
win7v20210408
Behavioral task
behavioral11
Sample
4072fc745ae1b976bfff8fdfdebdac6db5e33bb4f63507b4d56ab67b98c6db65.exe
Resource
win10v20210410
Behavioral task
behavioral12
Sample
42c8ded976a7c9f295888220d4d2fc273535f1fa15e6e25cfceaf454188f7895.exe
Resource
win7v20210408
Behavioral task
behavioral13
Sample
42c8ded976a7c9f295888220d4d2fc273535f1fa15e6e25cfceaf454188f7895.exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
52969fae09c2428c701a8b51a20c1eb07bab1bca79acb21eaa910d764533155d.rtf
Resource
win7v20210408
Behavioral task
behavioral15
Sample
52969fae09c2428c701a8b51a20c1eb07bab1bca79acb21eaa910d764533155d.rtf
Resource
win10v20210410
Behavioral task
behavioral16
Sample
571de4698edff95c328d3521b11e800a3b9659ad55281dd7729b2ce2210ac931.exe
Resource
win7v20210410
Behavioral task
behavioral17
Sample
571de4698edff95c328d3521b11e800a3b9659ad55281dd7729b2ce2210ac931.exe
Resource
win10v20210408
Behavioral task
behavioral18
Sample
57bb59a2c491b89b3321428121ba1b5e88daca5a8e379fde41afc73e9679d752.rtf
Resource
win7v20210410
Behavioral task
behavioral19
Sample
57bb59a2c491b89b3321428121ba1b5e88daca5a8e379fde41afc73e9679d752.rtf
Resource
win10v20210408
Behavioral task
behavioral20
Sample
662fbe23c87844a881ca233876ff75ee05ddf2ac0a1b5546fb5bc7603474860a.exe
Resource
win7v20210410
Behavioral task
behavioral21
Sample
662fbe23c87844a881ca233876ff75ee05ddf2ac0a1b5546fb5bc7603474860a.exe
Resource
win10v20210410
Behavioral task
behavioral22
Sample
70d5a71e821c8024fa2d5fb8a389390acc1289b88745fad61b6536cab0bd5191.dll
Resource
win7v20210410
Behavioral task
behavioral23
Sample
70d5a71e821c8024fa2d5fb8a389390acc1289b88745fad61b6536cab0bd5191.dll
Resource
win10v20210408
Behavioral task
behavioral24
Sample
71d384c258d0d2cfbeeda66a1ba67085b347d934a3484e0df3fc06a684085386.exe
Resource
win7v20210408
Behavioral task
behavioral25
Sample
71d384c258d0d2cfbeeda66a1ba67085b347d934a3484e0df3fc06a684085386.exe
Resource
win10v20210410
Behavioral task
behavioral26
Sample
79745c2263c8abe5b916e39e577652c029b5b586e7ccb39ee63ed0fc1568c39d.exe
Resource
win7v20210410
Behavioral task
behavioral27
Sample
79745c2263c8abe5b916e39e577652c029b5b586e7ccb39ee63ed0fc1568c39d.exe
Resource
win10v20210410
Behavioral task
behavioral28
Sample
83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe
Resource
win7v20210408
Behavioral task
behavioral29
Sample
83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe
Resource
win10v20210410
Behavioral task
behavioral30
Sample
8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
Resource
win7v20210410
Behavioral task
behavioral31
Sample
8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe
Resource
win10v20210408
Behavioral task
behavioral32
Sample
a3feb5265e6d02710f04ff618e966e9da9ba8fc8dc5692d6f7633fe0a3037b66.exe
Resource
win7v20210410
General
-
Target
4.zip
-
Size
29.8MB
-
MD5
ce09fd86f48ca550598456136c3878df
-
SHA1
3483bacb0ca5f7a36ddbf0a60268fa5b09bf4334
-
SHA256
2214bdc78b558176a17484bcc02079a5470e0b49073d50d19b522d67dc4396e3
-
SHA512
9277d9265eeadf617dec8a96faa2986cbc4354bbeabad544679f18b4537fba6c2c4889da51a538ccf0de5fa7717ab5e2e534476a5381dca268c3e3ba9a498d11
Malware Config
Extracted
gozi_ifsb
2500
todo.faroin.at
apr.intoolkom.at
r23cirt55ysvtdvl.onion
kas.kargoapp.at
io.feen007.at
gtk.uploner.at
l46t3vgvmtx5wxe6.onion
pop.biopiof.at
free.monotreener.com
tb.yapker.at
app.flashgameo.at
-
exe_type
worker
-
server_id
580
Signatures
-
Gozi_ifsb family
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack001/cee432dc98ab16fe238a59c066bcff4e7345b793e918215e1b5c55defad2eabd patched_upx -
resource yara_rule static1/unpack001/571de4698edff95c328d3521b11e800a3b9659ad55281dd7729b2ce2210ac931 vmprotect
Files
-
4.zip.zip
-
0f56c5738ae435abeac7a0928a5de2ff5d4082370c43f257a4c0589212f08901.elf linux arm
-
219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe windows x86
-
2a0f53dd66eff57c82fcad2fff75d7ac63f6f4d764ec27fe862e6b3f01a21c03.exe windows x86
-
36ef5e0db18469267810503ba4fd099e59007c3f10f718bccffdc93e87a853a0.exe windows x86
-
4072fc745ae1b976bfff8fdfdebdac6db5e33bb4f63507b4d56ab67b98c6db65.exe windows x86
-
42c8ded976a7c9f295888220d4d2fc273535f1fa15e6e25cfceaf454188f7895.exe windows x86
-
52969fae09c2428c701a8b51a20c1eb07bab1bca79acb21eaa910d764533155d.rtf
-
571de4698edff95c328d3521b11e800a3b9659ad55281dd7729b2ce2210ac931.exe windows x86
Exports
Exports
-
57bb59a2c491b89b3321428121ba1b5e88daca5a8e379fde41afc73e9679d752.rtf
-
662fbe23c87844a881ca233876ff75ee05ddf2ac0a1b5546fb5bc7603474860a.exe windows x86
-
70d5a71e821c8024fa2d5fb8a389390acc1289b88745fad61b6536cab0bd5191.dll windows x64
-
71d384c258d0d2cfbeeda66a1ba67085b347d934a3484e0df3fc06a684085386.exe windows x86
-
79745c2263c8abe5b916e39e577652c029b5b586e7ccb39ee63ed0fc1568c39d.exe windows x86
-
83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3.exe windows x86
Exports
Exports
@GetSecondVice@0
-
8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0.exe windows x86
-
a3feb5265e6d02710f04ff618e966e9da9ba8fc8dc5692d6f7633fe0a3037b66.exe windows x86
-
b1aa2c4b8aea86d296fb53aa4526c3e3d132f6a80b21334e5253fcdcc473a452.elf linux mipsel
-
b28811bb2049d77cf2c66e7f667ab4312d86b4e54e645d68ec9a0746f46e3bf7.exe windows x86
-
bc5d82859d4b7c567fa029977042a8e6629a2d1b3afa92b6f52a33d3006a068b.exe windows x86
-
c715f96c8313bb357821b1919217b2c0ff6fc5d2cd17991891673d7c14153604.elf linux arm
-
cb414e417f8f3de9392dbc6a89421d1a8e95beabbbe387e11771567d63a7b227.exe windows x86
-
cee432dc98ab16fe238a59c066bcff4e7345b793e918215e1b5c55defad2eabd.elf linux mipsbe
-
d9d63ec0992fc7234c2edf15653504a584e2de64251ee86654d7ef33691bcb7b.elf linux arm
-
deee0cbc7926b3bf60ae6071e6dc4233162cbfa125c649eb3979db7da100fa69.exe windows x86
-
df3dabd031184b67bab7043baaae17061c21939d725e751c0a6f6b7867d0cf34.exe windows x86
Exports
Exports
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
-
df921413ee769ff2ad5476498aab7f443580c866bb787e9eac42fb7e90a0d4d6.lnk
-
e19e0e7f8871e7acf07a37b277b5aaf2aa125f28ee11644c335eb313ec768df5.exe windows x86
Exports
Exports
@GetSecondVice@0
@GetViceVersa@12
-
e4d1670d1785eabdda12d45ee5c32c185863e1f3d049424a8c616a062659cb50.exe windows x86
Exports
Exports
@GetSecondVice@0
-
eb2a1f2067427229a3037c73914f2a978bd3a1ab074609fed5962e952db2a3c0.exe windows x86
-
f415487e104efb2d80000858f7942cd9db73526601066eca5e63d99a50926298.rtf
-
f6a377ba145a5503b5eb942d17645502eddf3a619d26a7b60df80a345917aaa2
-
ffe5b10cd81f4c1484f62863be69ea28732b8e765b12569c5cd11b463bd4d261.exe windows x86