gozi_ifsb | 5aaafc606bfb9fc80d39b7dabad49e4e33f1751a6cc1143248e3dd353e2be624

General

Target
5aaafc606bfb9fc80d39b7dabad49e4e33f1751a6cc1143248e3dd353e2be624
Size 81KB
Sample220802-c8p5haffa6
SHA256 5aaafc606bfb9fc80d39b7dabad49e4e33f1751a6cc1143248e3dd353e2be624
MD5 8ea23300fae31bec8ada43e748457e70
SHA1 f23b0fa8e2a23fcf48779caa4a9bbdb42cef9540
SHA512 f9924060ea38f86da2c2348d6dcc8d2cf23ce538db98bde13edc992c1c518f6b152ea96af2ea888e5680364850c280642a1cde0774c9edea73fa97bca0521acf
SSDEEP 1536:/CLAIbb8RGE8cdkVvqETSQFMDvYKSrn4B1EmX+5+hFRA:/CtP8AE8c+vrbrA1a+hFG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi_ifsb

Malware Config

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

5aaafc606bfb9fc80d39b7dabad49e4e33f1751a6cc1143248e3dd353e2be624

.exe 81KB

5aaafc606bfb9fc80d39b7dabad49e4e33f1751a6cc1143248e3dd353e2be624

IMPHASH d728679d8a5c4acc14e55ed38b997815
SHA256 5aaafc606bfb9fc80d39b7dabad49e4e33f1751a6cc1143248e3dd353e2be624
MD5 8ea23300fae31bec8ada43e748457e70
SHA1 f23b0fa8e2a23fcf48779caa4a9bbdb42cef9540
SHA512 f9924060ea38f86da2c2348d6dcc8d2cf23ce538db98bde13edc992c1c518f6b152ea96af2ea888e5680364850c280642a1cde0774c9edea73fa97bca0521acf
SSDEEP 1536:/CLAIbb8RGE8cdkVvqETSQFMDvYKSrn4B1EmX+5+hFRA:/CtP8AE8c+vrbrA1a+hFG
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

NtQuerySystemInformation ZwQueryInformationToken RtlNtStatusToDosError NtCreateSection memset NtMapViewOfSection NtUnmapViewOfSection memcpy ZwClose ZwOpenProcess ZwOpenProcessToken RtlUpcaseUnicodeString RtlFreeUnicodeString ZwQueryInformationProcess mbstowcs RtlImageNtHeader RtlUnwind NtQueryVirtualMemory

shlwapi

StrChrA StrRChrA StrChrW StrTrimW

kernel32

CloseHandle LoadLibraryA DeleteFileW ResetEvent CreateWaitableTimerA UnmapViewOfFile CreateProcessA CreateFileMappingA SetFileAttributesW HeapAlloc SetWaitableTimer lstrlenA GetExitCodeProcess GetProcAddress CreateEventA SetEvent lstrcatW GetLastError Sleep lstrlenW HeapFree GetCommandLineW ExitProcess GetModuleHandleA HeapCreate HeapDestroy WaitForSingleObject MapViewOfFile GetVersion lstrcmpA LocalFree ExpandEnvironmentStringsA lstrcpynA VirtualAlloc OpenProcess SuspendThread ResumeThread VirtualProtectEx VirtualFree GetCurrentProcessId GetLongPathNameW lstrcpyA FindFirstFileA FindClose CreateFileA FindNextFileA CompareFileTime lstrcatA GetFileTime SetFilePointer ReadFile GetModuleFileNameW GetModuleFileNameA SetLastError lstrcmpiA

user32

wsprintfA GetCursorInfo

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA RegQueryValueExA RegCloseKey RegOpenKeyExA

Sharing