gozi_ifsb | 1f23a1a0000[.]dll

General

Target
1f23a1a0000.dll
Size 256KB
Sample220308-pc7e5aefg9
SHA256 436d6d226550ed2e15292a65859fc41cde7cde6b34e83e10dff0518036cd1787
MD5 c7c9a41c20e3986dd1db45b5e44b60d3
SHA1 f3a8eef57d069a1113b08d894155065529a18cff
SHA512 4157cf5954883ca3f68633b7438bd44620c104d1fb715913d10ce423561a9673f6243810ef098a01a5dd1b7b53e18e7f34c65b6f3bcea0af43ca9b1aad71d180
MD5 SHA1 SHA512

Score

10^/10

777999 gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

777999

C2

config.edge.skype.com
67.43.234.14
67.43.234.37
67.43.234.47

Attributes

base_path
/images/
exe_type
worker
extension
.src
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

1f23a1a0000.dll

.dll 256KB

1f23a1a0000.dll

IMPHASH 1c569abf6588baf00e17998503c25cb6
SHA256 436d6d226550ed2e15292a65859fc41cde7cde6b34e83e10dff0518036cd1787
MD5 c7c9a41c20e3986dd1db45b5e44b60d3
SHA1 f3a8eef57d069a1113b08d894155065529a18cff
SHA512 4157cf5954883ca3f68633b7438bd44620c104d1fb715913d10ce423561a9673f6243810ef098a01a5dd1b7b53e18e7f34c65b6f3bcea0af43ca9b1aad71d180
MD5 SHA1 SHA512

windows x64

Minor OS version

Major OS version

Entry point

5928

Magic Number

523

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ZwOpenProcess ZwQueryInformationToken NtSetInformationProcess sprintf ZwOpenProcessToken strcpy ZwQueryInformationProcess RtlNtStatusToDosError NtQuerySystemInformation NtQueryInformationThread _wcsupr memmove wcscpy _snprintf mbstowcs ZwQueryKey RtlFreeUnicodeString RtlUpcaseUnicodeString wcstombs RtlAdjustPrivilege memset _strupr _snwprintf memcpy RtlImageNtHeader ZwClose __C_specific_handler __chkstk TlsAlloc VirtualProtectEx FileTimeToLocalFileTime CreateFileMappingW GetModuleFileNameA GetModuleFileNameW QueryPerformanceFrequency GetLocalTime FileTimeToSystemTime GetComputerNameExA GetComputerNameW QueryPerformanceCounter GetTempFileNameA CreateThread TerminateThread GetCurrentProcessId GetVersion HeapAlloc HeapFree WaitForSingleObject ExitThread lstrlenW GetLastError ResetEvent CloseHandle DeleteFileW CreateFileA lstrlenA WriteFile lstrcatA CreateDirectoryA RemoveDirectoryA LoadLibraryA DeleteFileA lstrcpyA HeapReAlloc SetEvent GetSystemTimeAsFileTime HeapDestroy HeapCreate GetModuleHandleA ExitProcess GetFileSize lstrcmpA SetWaitableTimer CreateDirectoryW GetTickCount GetCurrentThread VirtualFree GetWindowsDirectoryA GetCommandLineA InitializeCriticalSection OpenProcess Sleep CopyFileW CreateEventA LeaveCriticalSection TerminateProcess CreateFileW VirtualAlloc EnterCriticalSection lstrcmpiW lstrcatW GetCurrentThreadId DuplicateHandle GetTempPathA SuspendThread ResumeThread lstrcpyW SwitchToThread MapViewOfFile UnmapViewOfFile SetLastError lstrcmpiA OpenWaitableTimerA OpenMutexA WaitForMultipleObjects CreateMutexA ReleaseMutex CreateWaitableTimerA UnregisterWait TlsGetValue LoadLibraryExW TlsSetValue RegisterWaitForSingleObject VirtualProtect OpenEventA RemoveVectoredExceptionHandler AddVectoredExceptionHandler GetProcAddress GetDriveTypeW GetLogicalDriveStringsW WideCharToMultiByte GetExitCodeProcess CreateProcessA CreateFileMappingA OpenFileMappingA LocalFree lstrcpynA GlobalLock GlobalUnlock Thread32First Thread32Next QueueUserAPC OpenThread CreateToolhelp32Snapshot CallNamedPipeA WaitNamedPipeA ConnectNamedPipe ReadFile GetOverlappedResult DisconnectNamedPipe FlushFileBuffers CreateNamedPipeA CancelIo GetSystemTime SleepEx LocalAlloc FreeLibrary RaiseException DeleteCriticalSection VirtualQuery ExpandEnvironmentStringsW RemoveDirectoryW SetEndOfFile SetFilePointer FindNextFileW FindClose GetFileAttributesW SetFilePointerEx FindFirstFileW GetVersionExA

Sharing