Behavioral task
behavioral1
Sample
ef10953eb52b6f02587b99cfc4233603a6f63e653a71ab9d41c6ba66d2f199c6.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ef10953eb52b6f02587b99cfc4233603a6f63e653a71ab9d41c6ba66d2f199c6.dll
Resource
win10v2004-en-20220113
General
-
Target
ef10953eb52b6f02587b99cfc4233603a6f63e653a71ab9d41c6ba66d2f199c6
-
Size
716KB
-
MD5
fd2b80c12744d7e6cc6d74888f006e02
-
SHA1
34e39cab67be1fc2964d7295290c7d79832ecf13
-
SHA256
ef10953eb52b6f02587b99cfc4233603a6f63e653a71ab9d41c6ba66d2f199c6
-
SHA512
82d6089b57466fba81d9038136839390d74383f7566a31aaace1cc55907042079089e53c00edba649a98126edb57775dafde4b80da642a739226c133f18548b8
-
SSDEEP
12288:48+4Wm3V0FBEklIEC3zxpOzwazxRvWP8qC71L715+PoR5nFIlW2id:48+YcEkl0xszwyxRvkiJLT5FIV
Malware Config
Extracted
gozi_ifsb
1500
gtr.antoinfer.com
app.bighomegl.at
-
build
250211
-
exe_type
loader
-
server_id
580
Signatures
-
Gozi_ifsb family
Files
-
ef10953eb52b6f02587b99cfc4233603a6f63e653a71ab9d41c6ba66d2f199c6.dll windows x86
Code Sign
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 604B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 1024B - Virtual size: 620B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ