gozi_rm3 | 87058836bd1c2c7a428ae4a3b4729035dab25795fe4da55b3f5793cc115c611a

General

Target
87058836bd1c2c7a428ae4a3b4729035dab25795fe4da55b3f5793cc115c611a
Size 68KB
Sample220201-lx71lsdag2
SHA256 87058836bd1c2c7a428ae4a3b4729035dab25795fe4da55b3f5793cc115c611a
MD5 42aaa953a06706c56f64cb9f6d270677
SHA1 c27147895cc156862e5bf4d29e434f2fffc28a81
SHA512 a52e9b8718c7abc574a982b75c3ca7a7f6a5aac438ab0de8694060f72ca42b8c639b359d6d3ddb1b40d0a65066b1368f9514bcf35423f593a23bcf706865f6e9
SSDEEP 1536:yqRghPXChDUnQc1MrLWsWHgTnRRabR39Y04rS:y1hPyhDUnnMrDL+bJ9YTS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi_rm3

Malware Config

Extracted

Family

gozi_rm3

rsa_pubkey.plain

Signatures

Gozi_rm3 family
gozi_rm3

File Explorer

87058836bd1c2c7a428ae4a3b4729035dab25795fe4da55b3f5793cc115c611a

.dll 68KB

87058836bd1c2c7a428ae4a3b4729035dab25795fe4da55b3f5793cc115c611a

IMPHASH 39e34f289e8fd511f04654a06543337f
SHA256 87058836bd1c2c7a428ae4a3b4729035dab25795fe4da55b3f5793cc115c611a
MD5 42aaa953a06706c56f64cb9f6d270677
SHA1 c27147895cc156862e5bf4d29e434f2fffc28a81
SHA512 a52e9b8718c7abc574a982b75c3ca7a7f6a5aac438ab0de8694060f72ca42b8c639b359d6d3ddb1b40d0a65066b1368f9514bcf35423f593a23bcf706865f6e9
SSDEEP 1536:yqRghPXChDUnQc1MrLWsWHgTnRRabR39Y04rS:y1hPyhDUnnMrDL+bJ9YTS
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

30744

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_AGGRESIVE_WS_TRIM IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

ntdll

NtCreateKey NtDeleteValueKey NtSetValueKey NtQueryValueKey NtOpenKey memmove memcmp mbstowcs _strupr RtlImageNtHeader wcstombs NtQueryInformationToken NtOpenProcessToken NtProtectVirtualMemory NtAllocateVirtualMemory _wcsupr NtQueryVirtualMemory NtOpenFile NtSetInformationProcess memset NtMapViewOfSection NtOpenSection NtQueryInformationProcess strrchr RtlInitUnicodeString RtlNtStatusToDosError _snwprintf LdrFindEntryForAddress strchr wcsrchr NtClose NtUnmapViewOfSection memcpy _aulldiv _allmul RtlUnwind

kernel32

CreateProcessA GetModuleHandleA lstrlenW TlsSetValue TlsGetValue GetProcessId CreateProcessW lstrcatW GetLastError OpenEventW SetLastError Sleep EnterCriticalSection CloseHandle HeapDestroy lstrcpyW ResetEvent LeaveCriticalSection HeapCreate WaitForSingleObject SetEvent AddVectoredExceptionHandler RemoveVectoredExceptionHandler CreateEventW CreateMutexW ExitThread GetProcAddress SleepEx lstrcpyA lstrcmpA lstrlenA InitializeCriticalSection VirtualFree GetCurrentThreadId GetModuleHandleExW ReadFile CancelIo GetOverlappedResult WaitNamedPipeW WriteFile CreateEventA GetModuleFileNameW LoadLibraryA GetSystemTimeAsFileTime SetThreadContext GetThreadContext CreateThread ProcessIdToSessionId GetCurrentProcessId WaitForMultipleObjects SetFilePointer ResumeThread CheckRemoteDebuggerPresent TlsAlloc OpenProcess HeapFree HeapAlloc HeapReAlloc lstrcmpiA

Sharing