gozi_ifsb | c6a0000[.]dll

General

Target
c6a0000.dll
Size 227KB
Sample220803-qnyg2acefl
SHA256 488925a89527506e1e40d24e0599e758bcf44bdd788f9da852823c27898d164e
MD5 f6a83fc0075e66391e5511de2fa10a05
SHA1 0711fbea9edef5179f2c7ac7f25014a127bf06eb
SHA512 9ad22154034414a413cd8f8f9c641a33f956ec1c733c204589dc67f0c8c8521f72a608f1ddce2ddcd4b7345faa4b9057374eb5ddfed5c7a719002486860fb9d2
SSDEEP 3072:X5hinZgCo+NjJWSsznC2OCyzjFIz4V1T/JDR1vHBB78C752cjJT5e:X+nZ1o+NJWbn2CMFIzSTRDR1vHR5B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

11111 gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

11111

C2

trackin1g-protection.cdnn.mozilla.net
176.10.119.80
194.76.224.245
31.214.157.77
chnkdgpopupser.at
185.158.250.220
185.158.250.234
194.76.224.181

Attributes

base_path
/fonts/
exe_type
worker
extension
.bak
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

c6a0000.dll

.dll 227KB

c6a0000.dll

IMPHASH 81de4ee1071a8320787d7c9e149ace7f
SHA256 488925a89527506e1e40d24e0599e758bcf44bdd788f9da852823c27898d164e
MD5 f6a83fc0075e66391e5511de2fa10a05
SHA1 0711fbea9edef5179f2c7ac7f25014a127bf06eb
SHA512 9ad22154034414a413cd8f8f9c641a33f956ec1c733c204589dc67f0c8c8521f72a608f1ddce2ddcd4b7345faa4b9057374eb5ddfed5c7a719002486860fb9d2
SSDEEP 3072:X5hinZgCo+NjJWSsznC2OCyzjFIz4V1T/JDR1vHBB78C752cjJT5e:X+nZ1o+NJWbn2CMFIzSTRDR1vHR5B
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

165220

Magic Number

523

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ZwOpenProcess ZwQueryInformationToken NtSetInformationProcess sprintf ZwOpenProcessToken strcpy ZwQueryInformationProcess RtlNtStatusToDosError NtQuerySystemInformation NtQueryInformationThread _wcsupr memmove wcscpy _snprintf mbstowcs ZwQueryKey NtResumeProcess RtlFreeUnicodeString RtlUpcaseUnicodeString NtSuspendProcess wcstombs RtlAdjustPrivilege memset _strupr _snwprintf memcpy RtlImageNtHeader ZwClose __C_specific_handler __chkstk RegisterWaitForSingleObject VirtualProtectEx FileTimeToLocalFileTime CreateFileMappingW GetModuleFileNameA GetModuleFileNameW QueryPerformanceFrequency GetLocalTime FileTimeToSystemTime GetComputerNameExA GetComputerNameW QueryPerformanceCounter GetTempFileNameA CreateThread TerminateThread GetCurrentProcessId GetVersion DeleteCriticalSection HeapAlloc HeapFree WaitForSingleObject ExitThread lstrlenW GetLastError ResetEvent CloseHandle DeleteFileW CreateFileA lstrlenA WriteFile lstrcatA CreateDirectoryA RemoveDirectoryA LoadLibraryA DeleteFileA lstrcpyA HeapReAlloc SetEvent GetSystemTimeAsFileTime HeapDestroy HeapCreate GetModuleHandleA ExitProcess GetFileSize lstrcmpA SetWaitableTimer CreateDirectoryW GetTickCount GetCurrentThread VirtualFree GetWindowsDirectoryA GetCommandLineA InitializeCriticalSection OpenProcess Sleep CopyFileW CreateEventA LeaveCriticalSection TerminateProcess CreateFileW VirtualAlloc EnterCriticalSection lstrcmpiW lstrcatW GetCurrentThreadId DuplicateHandle GetTempPathA SuspendThread ResumeThread lstrcpyW SwitchToThread MapViewOfFile UnmapViewOfFile SetLastError lstrcmpiA OpenWaitableTimerA OpenMutexA WaitForMultipleObjects CreateMutexA ReleaseMutex CreateWaitableTimerA UnregisterWait TlsGetValue LoadLibraryExW TlsSetValue VirtualQuery VirtualProtect TlsAlloc GetProcAddress OpenEventA RemoveVectoredExceptionHandler AddVectoredExceptionHandler GetDriveTypeW GetLogicalDriveStringsW WideCharToMultiByte GetExitCodeProcess CreateProcessA CreateFileMappingA OpenFileMappingA LocalFree lstrcpynA GlobalLock GlobalUnlock Thread32First Thread32Next QueueUserAPC OpenThread CreateToolhelp32Snapshot CallNamedPipeA WaitNamedPipeA ConnectNamedPipe ReadFile GetOverlappedResult DisconnectNamedPipe FlushFileBuffers CreateNamedPipeA CancelIo GetSystemTime SleepEx LocalAlloc FreeLibrary RaiseException ExpandEnvironmentStringsW RemoveDirectoryW SetEndOfFile SetFilePointer FindNextFileW FindClose GetFileAttributesW SetFilePointerEx FindFirstFileW GetVersionExA

Sharing