gozi_ifsb | 155c8600000[.]dll

General

Target
155c8600000.dll
Size 215KB
Sample220808-ml58babfh3
SHA256 2df2eb7dff15cb80269452e6fe93c839f7f995ae69c961d087a54d329b0dc6c8
MD5 41c5408a5eb15282b1bdd3971cbd2b70
SHA1 b1594753e47702056a4da29d7abdc5b6f60c31dc
SHA512 4723f8517c805fb6500d0af2a9e53fbf2a46667530241ca94490cf1b0badedd7f4c6328005b768dba69f3b777ac0417a0d326946290fdaf01d9e01ad3a89872c
SSDEEP 6144:yOZiNwkzdjpi5azwE2uP3qqMFTXvAe59jwNq:yHwkx9cazwE2Y3q9TXvAJN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

3000 gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

94.198.40.47
94.198.40.58
havefuntxmm.at

Attributes

base_path
/images/
exe_type
worker
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

155c8600000.dll

.dll 215KB

155c8600000.dll

IMPHASH a1ef83cc18cbaac921ccd21be4b7287d
SHA256 2df2eb7dff15cb80269452e6fe93c839f7f995ae69c961d087a54d329b0dc6c8
MD5 41c5408a5eb15282b1bdd3971cbd2b70
SHA1 b1594753e47702056a4da29d7abdc5b6f60c31dc
SHA512 4723f8517c805fb6500d0af2a9e53fbf2a46667530241ca94490cf1b0badedd7f4c6328005b768dba69f3b777ac0417a0d326946290fdaf01d9e01ad3a89872c
SSDEEP 6144:yOZiNwkzdjpi5azwE2uP3qqMFTXvAe59jwNq:yHwkx9cazwE2Y3q9TXvAJN
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

19896

Magic Number

523

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ZwClose ZwOpenProcess ZwQueryInformationToken NtSetInformationProcess sprintf strcpy ZwQueryInformationProcess RtlNtStatusToDosError NtQuerySystemInformation NtQueryInformationThread _wcsupr memmove wcscpy _snprintf mbstowcs ZwQueryKey NtResumeProcess RtlFreeUnicodeString RtlUpcaseUnicodeString NtSuspendProcess wcstombs RtlAdjustPrivilege memset _strupr _snwprintf memcpy RtlImageNtHeader ZwOpenProcessToken __C_specific_handler __chkstk RegisterWaitForSingleObject VirtualProtectEx CreateFileMappingW GetModuleFileNameA GetModuleFileNameW QueryPerformanceFrequency GetLocalTime GetComputerNameExA GetComputerNameW QueryPerformanceCounter GetTempFileNameA CreateThread TerminateThread GetCurrentProcessId GetVersion DeleteCriticalSection VirtualQuery HeapAlloc HeapFree WaitForSingleObject ExitThread lstrlenW GetLastError ResetEvent CloseHandle DeleteFileW CreateFileA lstrlenA WriteFile lstrcatA CreateDirectoryA RemoveDirectoryA LoadLibraryA DeleteFileA lstrcpyA HeapReAlloc SetEvent GetSystemTimeAsFileTime HeapDestroy HeapCreate GetModuleHandleA ExitProcess GetFileSize lstrcmpA SetWaitableTimer CreateDirectoryW GetTickCount GetCurrentThread VirtualFree GetWindowsDirectoryA GetCommandLineA InitializeCriticalSection OpenProcess Sleep CopyFileW CreateEventA LeaveCriticalSection TerminateProcess CreateFileW VirtualAlloc EnterCriticalSection lstrcmpiW lstrcatW GetCurrentThreadId DuplicateHandle GetTempPathA SuspendThread ResumeThread lstrcpyW SwitchToThread MapViewOfFile UnmapViewOfFile SetLastError lstrcmpiA OpenWaitableTimerA OpenMutexA WaitForMultipleObjects CreateMutexA ReleaseMutex CreateWaitableTimerA UnregisterWait TlsGetValue LoadLibraryExW TlsSetValue ExpandEnvironmentStringsW VirtualProtect TlsAlloc GetProcAddress OpenEventA RemoveVectoredExceptionHandler AddVectoredExceptionHandler GetDriveTypeW GetLogicalDriveStringsW WideCharToMultiByte GetExitCodeProcess CreateProcessA CreateFileMappingA OpenFileMappingA LocalFree lstrcpynA Thread32First Thread32Next QueueUserAPC OpenThread CreateToolhelp32Snapshot CallNamedPipeA WaitNamedPipeA ConnectNamedPipe ReadFile GetOverlappedResult DisconnectNamedPipe FlushFileBuffers CreateNamedPipeA CancelIo GetSystemTime SleepEx LocalAlloc FreeLibrary RaiseException RemoveDirectoryW SetEndOfFile SetFilePointer FindNextFileW FindClose GetFileAttributesW SetFilePointerEx FindFirstFileW GetVersionExA

Sharing