gozi_ifsb | 0eebbf4f97ebd2de2472e0cc7ce4a989fa4ce8142f4e2795d0e97442d1c0d530

General

Target
0eebbf4f97ebd2de2472e0cc7ce4a989fa4ce8142f4e2795d0e97442d1c0d530
Size 194KB
Sample220201-m1ghhadccl
SHA256 0eebbf4f97ebd2de2472e0cc7ce4a989fa4ce8142f4e2795d0e97442d1c0d530
MD5 86c5ce297d05177045f1f072dbe5b3ae
SHA1 b1eca726f225b3a54f4a667fc0b9f3807cc637ab
SHA512 dd5c28ebfb7c8ee8f74dc55e9d830d64bd233fe8e7c400c29c9b52c77d3295ada16188f6a0a5f1121d5f976f150f85d91f065cc6b7fb5f59c1d4b260105f5c4f
SSDEEP 3072:I5pn/jsSe0NjAaGyo/J8rBnc2Loreafl72GgZav5+AOaZ1/0:WlsSe0NTG7B8r1cAoiaf2Zs8w8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

1051 gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1051

C2

cbcvbaarogonase.net
vvvondiasnew.net
uuuansdownew.net

Attributes

dga_season
10
dga_tlds
com

ru

org
exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

0eebbf4f97ebd2de2472e0cc7ce4a989fa4ce8142f4e2795d0e97442d1c0d530

.dll 194KB

0eebbf4f97ebd2de2472e0cc7ce4a989fa4ce8142f4e2795d0e97442d1c0d530

IMPHASH e160cc3f172ae4c4d2fd7b70aab20cf3
SHA256 0eebbf4f97ebd2de2472e0cc7ce4a989fa4ce8142f4e2795d0e97442d1c0d530
MD5 86c5ce297d05177045f1f072dbe5b3ae
SHA1 b1eca726f225b3a54f4a667fc0b9f3807cc637ab
SHA512 dd5c28ebfb7c8ee8f74dc55e9d830d64bd233fe8e7c400c29c9b52c77d3295ada16188f6a0a5f1121d5f976f150f85d91f065cc6b7fb5f59c1d4b260105f5c4f
SSDEEP 3072:I5pn/jsSe0NjAaGyo/J8rBnc2Loreafl72GgZav5+AOaZ1/0:WlsSe0NTG7B8r1cAoiaf2Zs8w8
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

5804

Magic Number

523

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sprintf NtMapViewOfSection NtUnmapViewOfSection NtCreateSection strcpy ZwOpenProcess ZwOpenProcessToken ZwClose ZwQueryInformationToken NtQuerySystemInformation RtlNtStatusToDosError ZwQueryInformationProcess _snprintf _strupr _wcsupr memmove wcscpy memset RtlFreeUnicodeString ZwQueryKey RtlUpcaseUnicodeString wcstombs RtlAdjustPrivilege mbstowcs RtlImageNtHeader memcpy __C_specific_handler CreateFileMappingA VirtualProtectEx FileTimeToLocalFileTime QueueUserWorkItem CompareFileTime FindFirstFileA GetFileTime FindNextFileA ExpandEnvironmentStringsA GetCurrentProcessId GetModuleFileNameW FileTimeToSystemTime GetVersion GetLocalTime CreateDirectoryA GetLastError HeapFree RemoveDirectoryA CloseHandle LoadLibraryA CreateFileA DeleteFileA lstrcpyA lstrlenA lstrcatA WriteFile HeapAlloc HeapDestroy HeapCreate SetEvent HeapReAlloc GetSystemTimeAsFileTime SuspendThread lstrcmpiW ResumeThread GetModuleHandleA lstrcpyW CreateFileW CreateThread lstrcatW SwitchToThread Sleep GetTickCount CopyFileW SetWaitableTimer GetCurrentThread GetCurrentThreadId DuplicateHandle lstrlenW CreateEventA GetWindowsDirectoryA CreateDirectoryW DeleteFileW GetTempPathA WaitForSingleObject OpenProcess lstrcmpA ResetEvent CreateMutexA MapViewOfFile OpenWaitableTimerA UnmapViewOfFile OpenMutexA ReleaseMutex GetVersionExA CreateWaitableTimerA SetLastError lstrcmpiA WaitForMultipleObjects InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualProtect RegisterWaitForSingleObject TlsAlloc TlsGetValue LoadLibraryExW TlsSetValue VirtualAlloc UnregisterWait GetProcAddress GetFileAttributesW GetFileSize CreateProcessA GetComputerNameW GetDriveTypeW WideCharToMultiByte GetLogicalDriveStringsW GetFileAttributesA OpenFileMappingA GetExitCodeProcess lstrcpynA GlobalUnlock LocalFree GlobalLock Thread32First CreateToolhelp32Snapshot QueueUserAPC OpenThread Thread32Next GetOverlappedResult CancelIo DisconnectNamedPipe FlushFileBuffers CallNamedPipeA CreateNamedPipeA GetSystemTime WaitNamedPipeA ReadFile ConnectNamedPipe SleepEx AddVectoredExceptionHandler RemoveVectoredExceptionHandler OpenEventA ExitThread LocalAlloc FreeLibrary RaiseException GetModuleFileNameA VirtualFree DeleteCriticalSection ExpandEnvironmentStringsW FindClose GetTempFileNameA SetEndOfFile FindNextFileW SetFilePointer FindFirstFileW RemoveDirectoryW

Sharing