gozi_ifsb | 0f636ca98aab74539b06036f03e10f69d658803a3f180b8f5897e972aa626102

General

Target

0f636ca98aab74539b06036f03e10f69d658803a3f180b8f5897e972aa626102
Size

109KB
MD5

d04d2a5f304cc7a6c3583e65c4cefead
SHA1

b58c136b8ca58a4f3dbfd72154756dfd041d1315
SHA256

0f636ca98aab74539b06036f03e10f69d658803a3f180b8f5897e972aa626102
SHA512

62f0f2939235e4fac5c9af7ba3d686837b305714026d802a07cd6a5ce0d97f83042b5c006232dac19d4eebb7e6c8007c1ad6bb12b8d10d1ad42f2906a21d08dc
SSDEEP

768:PnokLrDvjpBcQs5nhBoGFwfrs9BmGDXI4bFouio6:rLbjHizsiLI4WuB

Score

10^/10

1500 gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1500

C2

app.buboleinov.com

chat.veminiare.com

chat.billionady.com

app3.maintorna.com

Attributes

build
250188
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Signatures

Gozi_ifsb family
gozi_ifsb

Files

0f636ca98aab74539b06036f03e10f69d658803a3f180b8f5897e972aa626102
.dll regsvr32 windows x86

6645a948149623e814d378b0c62a0e68

Code Sign

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrIA

kernel32

SetThreadAffinityMask
HeapAlloc
GetLastError
VerLanguageNameA
Sleep
GetSystemTime
SwitchToThread
HeapFree
SleepEx
GetLocaleInfoA
ExitThread
lstrlenW
GetSystemDefaultUILanguage
WaitForSingleObject
HeapCreate
InterlockedDecrement
HeapDestroy
InterlockedIncrement
CloseHandle
SetThreadPriority
GetCurrentThread
GetExitCodeThread
GetModuleFileNameW
CreateFileMappingW
MapViewOfFile
GetSystemTimeAsFileTime
SetLastError
GetModuleHandleA
VirtualProtect
OpenProcess
GetVersion
GetCurrentProcessId
CreateEventA
GetLongPathNameW
QueueUserAPC
CreateThread
TerminateThread
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc

ntdll

_snwprintf
memcpy
memset
_aulldiv
RtlUnwind
NtQueryVirtualMemory

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA

Exports

Exports

DllRegisterServer

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 604B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

6645a948149623e814d378b0c62a0e68

Code Sign

Headers

File Characteristics

Imports

shlwapi

kernel32

ntdll

advapi32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 604B

.bss Size: 1024B - Virtual size: 620B

.reloc Size: 28KB - Virtual size: 32KB

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 604B

.bss
Size: 1024B - Virtual size: 620B

.reloc
Size: 28KB - Virtual size: 32KB