gozi_ifsb | 123e2c58[.]dll

General

Target
123e2c58.dll
Size 676KB
Sample220920-ldngvscee6
SHA256 add170faa3d2a629d9fdd4d71c1652b8a42309d67a86bd52024ea86c5fa1d7a9
MD5 e1a8e00a06f26ef92e01e48ba39cae74
SHA1 06b73afa6db30f6d9b35846cdef32b8212406702
SHA512 e90cbcb5e965276257a3f5f88076bf9f38129a3cd11414f2c4f99c71d2ee8b75831713b970e9b7de830986ef625f8ea20f96adab15a231d00318147793476a6e
SSDEEP 12288:NymbIP35LmP3bS1qRlP5ukahaNNLiBaFNmz1lZxjSiXrwsHphTukEtv:NymcP3oPG1qRoha/qaa5t5VJhSkEx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi_ifsb

Malware Config

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

123e2c58.dll

.dll 676KB

123e2c58.dll

IMPHASH 5534df2e4afbee1daa1faf26d0a717bc
SHA256 add170faa3d2a629d9fdd4d71c1652b8a42309d67a86bd52024ea86c5fa1d7a9
MD5 e1a8e00a06f26ef92e01e48ba39cae74
SHA1 06b73afa6db30f6d9b35846cdef32b8212406702
SHA512 e90cbcb5e965276257a3f5f88076bf9f38129a3cd11414f2c4f99c71d2ee8b75831713b970e9b7de830986ef625f8ea20f96adab15a231d00318147793476a6e
SSDEEP 12288:NymbIP35LmP3bS1qRlP5ukahaNNLiBaFNmz1lZxjSiXrwsHphTukEtv:NymcP3oPG1qRoha/qaa5t5VJhSkEx
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

121372

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

_strnicmp memcmp memset _strupr strcpy ZwQueryInformationProcess ZwQueryKey NtSuspendProcess NtSetContextThread RtlNtStatusToDosError NtResumeProcess NtGetContextThread _wcsnicmp LdrFindEntryForAddress NtMapViewOfSection NtUnmapViewOfSection ZwClose NtCreateSection memmove NtQuerySystemInformation RtlInitUnicodeString NtQueryInformationFile NtQueryInformationProcess NtQueryDirectoryFile NtQueryObject ZwOpenProcessToken ZwOpenProcess ZwQueryInformationToken RtlEqualUnicodeString NtSetInformationProcess _snprintf memcpy _alldiv _chkstk RtlUnwind NtQueryVirtualMemory

kernel32

VirtualFree RaiseException CreateIoCompletionPort PostQueuedCompletionStatus InterlockedExchange GetSystemInfo GetQueuedCompletionStatus CreateWaitableTimerA OpenThread HeapReAlloc RemoveVectoredExceptionHandler HeapAlloc HeapFree SetEvent CreateEventA HeapDestroy HeapCreate GetLastError LocalAlloc AddVectoredExceptionHandler GetCurrentThreadId GetVersion LocalFree GetSystemTime SwitchToThread lstrlenA WideCharToMultiByte lstrcatA MultiByteToWideChar lstrlenW SetLastError lstrcmpiW lstrcatW lstrcpyW lstrcpyA WaitForSingleObject InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleHandleA DeleteCriticalSection CloseHandle CreateThread GetComputerNameW CreateMutexA GetCurrentProcessId lstrcpynA lstrcpynW lstrcmpiA SetEnvironmentVariableW SetErrorMode SetUnhandledExceptionFilter OpenProcess Sleep TerminateProcess GetProcAddress WaitForMultipleObjects LoadLibraryA InterlockedIncrement InterlockedDecrement CreateDirectoryW ReleaseMutex GlobalDeleteAtom GlobalAddAtomA IsBadReadPtr IsBadStringPtrA CreateFileA SetFilePointer SetEndOfFile ExpandEnvironmentStringsA WriteFile FreeLibrary lstrcmpA VirtualQuery GetCurrentProcess VirtualProtect ExpandEnvironmentStringsW GetVersionExW GetFileSize ReadFile CreateFileW GetTempPathW GetLongPathNameW ResetEvent ReadProcessMemory VirtualAlloc VirtualAllocEx GetModuleFileNameA WriteProcessMemory GetThreadContext VirtualProtectEx SuspendThread ResumeThread CopyFileW GetFileAttributesExW FindFirstFileW CompareFileTime lstrcmpW FindClose FindNextFileW GetEnvironmentVariableW MapViewOfFile UnmapViewOfFile CreateFileMappingA OpenFileMappingA GlobalLock GlobalAlloc GlobalUnlock GlobalFree OpenEventA GetSystemWindowsDirectoryA SetFilePointerEx GetFileInformationByHandleEx SetFileInformationByHandle GetProcessId RemoveDirectoryW DuplicateHandle DeleteFileW MulDiv GetTickCount GetSystemTimeAsFileTime GetProcessTimes GetLocaleInfoW VerLanguageNameW SetWaitableTimer CancelWaitableTimer WaitForSingleObjectEx SystemTimeToFileTime

mswsock

AcceptEx GetAcceptExSockaddrs

Sharing