gozi_ifsb | 096528a084f4e6830ec5c040276c866efa10dd8a73c1fcf8ab2a3710fc357b9f

General

Target
096528a084f4e6830ec5c040276c866efa10dd8a73c1fcf8ab2a3710fc357b9f
Size 131KB
Sample220201-m3j2eadgb2
SHA256 096528a084f4e6830ec5c040276c866efa10dd8a73c1fcf8ab2a3710fc357b9f
MD5 0a6064523fd0830c591d57f76f8934ce
SHA1 458d47631fed235453fefffc343120ad3d19b6b6
SHA512 021f8e5c138da9bc79994a5c9a6485e458433752e238bc2982fc3116d194003e7dd9df6fff7ce0c9a6caa0391d7000f08a64006070930ddfa1918bcb7a4567a2
SSDEEP 3072:ATHfYUXYQKM0Do87PVqlalXn6RCMVUzBOisJvvREpBC:ALfYUXYhr7Nqlal6VUzBOix
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

777009 gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

777009

Attributes

build
213551
exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

096528a084f4e6830ec5c040276c866efa10dd8a73c1fcf8ab2a3710fc357b9f

.dll 131KB

096528a084f4e6830ec5c040276c866efa10dd8a73c1fcf8ab2a3710fc357b9f

IMPHASH fc4e0754f41cf16cfe6825550a52b5a3
SHA256 096528a084f4e6830ec5c040276c866efa10dd8a73c1fcf8ab2a3710fc357b9f
MD5 0a6064523fd0830c591d57f76f8934ce
SHA1 458d47631fed235453fefffc343120ad3d19b6b6
SHA512 021f8e5c138da9bc79994a5c9a6485e458433752e238bc2982fc3116d194003e7dd9df6fff7ce0c9a6caa0391d7000f08a64006070930ddfa1918bcb7a4567a2
SSDEEP 3072:ATHfYUXYQKM0Do87PVqlalXn6RCMVUzBOisJvvREpBC:ALfYUXYhr7Nqlal6VUzBOix
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

5046

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

sprintf strcpy ZwQueryInformationToken ZwOpenProcessToken ZwOpenProcess NtSetContextThread NtGetContextThread ZwQueryInformationProcess ZwClose RtlNtStatusToDosError NtCreateSection NtMapViewOfSection NtUnmapViewOfSection memcpy _wcsupr _strupr memset wcscpy ZwQueryKey wcstombs RtlAdjustPrivilege mbstowcs RtlImageNtHeader _snprintf _aulldiv _allmul _chkstk RtlUnwind NtQueryVirtualMemory

kernel32

InterlockedExchange lstrcmpW GetModuleFileNameW GetModuleFileNameA GetLocalTime VirtualFree VirtualAllocEx VirtualAlloc CreateFileA lstrcatA lstrlenA WriteFile CloseHandle CreateDirectoryA GetLastError HeapAlloc RemoveDirectoryA DeleteFileA lstrcpyA HeapFree LoadLibraryA SetEvent HeapReAlloc GetTickCount InterlockedIncrement InterlockedDecrement HeapDestroy HeapCreate lstrcatW GetSystemTimeAsFileTime GetWindowsDirectoryA GetCurrentProcess GetCurrentThreadId CreateDirectoryW DeleteFileW GetTempPathA SuspendThread ResumeThread lstrlenW lstrcpyW Sleep CopyFileW CreateThread SwitchToThread CreateEventA SetWaitableTimer GetProcAddress GetCurrentThread WaitForMultipleObjects lstrcmpiA WaitForSingleObject GetComputerNameW lstrcmpA LeaveCriticalSection CreateMutexA EnterCriticalSection MapViewOfFile UnmapViewOfFile ReleaseMutex CreateWaitableTimerA GetSystemTime InitializeCriticalSection RegisterWaitForSingleObject UnregisterWait GetModuleHandleA LoadLibraryExW SetLastError GetDriveTypeW OpenFileMappingA WideCharToMultiByte LocalFree GetLogicalDriveStringsW GetExitCodeProcess CreateFileMappingA CreateProcessA CreateFileW GetFileSize lstrcpynA TlsGetValue TlsSetValue TlsAlloc GlobalUnlock GetCurrentProcessId GlobalLock CreateToolhelp32Snapshot QueueUserAPC Thread32First OpenThread Thread32Next ReadFile CancelIo ConnectNamedPipe GetOverlappedResult DisconnectNamedPipe FlushFileBuffers CreateNamedPipeA CallNamedPipeA WaitNamedPipeA RemoveVectoredExceptionHandler AddVectoredExceptionHandler SleepEx ResetEvent LocalAlloc FreeLibrary RaiseException GetVersion DeleteCriticalSection VirtualProtect SetEndOfFile ExpandEnvironmentStringsW SetFilePointer FindFirstFileW GetFileAttributesW FindNextFileW RemoveDirectoryW FindClose GetTempFileNameA GetThreadContext ReadProcessMemory VirtualProtectEx WriteProcessMemory OpenProcess CreateRemoteThread SetFilePointerEx

Sharing