Behavioral task
behavioral1
Sample
4b10000.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4b10000.dll
Resource
win10v2004-20220812-en
General
-
Target
4b10000.dll
-
Size
42KB
-
MD5
c5a7fdb56c469061235d3fcd18c428b3
-
SHA1
ad64048347db27be394ebcfe607023da60babff9
-
SHA256
ca1216f246e4bd95446005f0ead479f491c173431c09f0df908228888a38844a
-
SHA512
07b828c3763253ede6b6f290b0e3222252e33740b314ddbf1ed6e65086c311da7bf2196562e8050a1169748eaf35ea2498f7cbf1429c60626b8e33d1e652ae00
-
SSDEEP
768:+OLe6E/Bm/VvoaL2VUZE2SQ6hMPWBIOgv17yDLimRpOBDKMxNawXkb:L/VgvVUZE2SQ6hKw9gv17yDLi8pOl/ad
Malware Config
Extracted
gozi_ifsb
47470
asiorpatms.com
unpeoritas.art
-
build
250234
-
exe_type
loader
-
server_id
580
Signatures
-
Gozi_ifsb family
Files
-
4b10000.dll.dll windows x86
b31a178c0959494b1346349520b9e449
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ord6
ord16
ord15
ord2
Sections
.text Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ