gozi_ifsb | 6450000[.]dll[.]exe

General

Target
6450000.dll.exe
Size 227KB
Sample220922-jfss9aebhk
SHA256 d7c21a2d7356de716a0d38bd83ca240c7c12b3830494ffde30e3599fa2243b5c
MD5 ba91db1fedca355bc7ace391f0a32390
SHA1 e17491e4e65a60f4860f8ac56125b51e5e9039f8
SHA512 805776d402a5c2795425e643ae23eaf1c5cb59b0d509fe30c7728403f2e93388d7a5d075c3749f8820e23a578341963a6ac638c5927e9278533f6915dba3ea30
SSDEEP 3072:dlfGqwJTeTEom3lIkR2SCD6q9KgyItk78mV0dfgxT/cqAww5VgCK5hcjeZxJFoc:dlDosEPR66q9KgylInd6oqAwD5HnFoc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

10101 gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

10101

C2

trackingg-protectioon.cdn1.mozilla.net
45.8.158.104
188.127.224.114
weiqeqwns.com
wdeiqeqwns.com
weiqeqwens.com
weiqewqwns.com
iujdhsndjfks.com

Attributes

base_path
/uploaded/
exe_type
worker
extension
.pct
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

6450000.dll.exe

.dll 227KB

6450000.dll.exe

IMPHASH 81de4ee1071a8320787d7c9e149ace7f
SHA256 d7c21a2d7356de716a0d38bd83ca240c7c12b3830494ffde30e3599fa2243b5c
MD5 ba91db1fedca355bc7ace391f0a32390
SHA1 e17491e4e65a60f4860f8ac56125b51e5e9039f8
SHA512 805776d402a5c2795425e643ae23eaf1c5cb59b0d509fe30c7728403f2e93388d7a5d075c3749f8820e23a578341963a6ac638c5927e9278533f6915dba3ea30
SSDEEP 3072:dlfGqwJTeTEom3lIkR2SCD6q9KgyItk78mV0dfgxT/cqAww5VgCK5hcjeZxJFoc:dlDosEPR66q9KgylInd6oqAwD5HnFoc
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

44448

Magic Number

523

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ZwOpenProcess ZwQueryInformationToken NtSetInformationProcess sprintf ZwOpenProcessToken strcpy ZwQueryInformationProcess RtlNtStatusToDosError NtQuerySystemInformation NtQueryInformationThread _wcsupr memmove wcscpy _snprintf mbstowcs ZwQueryKey NtResumeProcess RtlFreeUnicodeString RtlUpcaseUnicodeString NtSuspendProcess wcstombs RtlAdjustPrivilege memset _strupr _snwprintf memcpy RtlImageNtHeader ZwClose __C_specific_handler __chkstk RegisterWaitForSingleObject VirtualProtectEx FileTimeToLocalFileTime CreateFileMappingW GetModuleFileNameA GetModuleFileNameW QueryPerformanceFrequency GetLocalTime FileTimeToSystemTime GetComputerNameExA GetComputerNameW QueryPerformanceCounter GetTempFileNameA CreateThread TerminateThread GetCurrentProcessId GetVersion DeleteCriticalSection HeapAlloc HeapFree WaitForSingleObject ExitThread lstrlenW GetLastError ResetEvent CloseHandle DeleteFileW CreateFileA lstrlenA WriteFile lstrcatA CreateDirectoryA RemoveDirectoryA LoadLibraryA DeleteFileA lstrcpyA HeapReAlloc SetEvent GetSystemTimeAsFileTime HeapDestroy HeapCreate GetModuleHandleA ExitProcess GetFileSize lstrcmpA SetWaitableTimer CreateDirectoryW GetTickCount GetCurrentThread VirtualFree GetWindowsDirectoryA GetCommandLineA InitializeCriticalSection OpenProcess Sleep CopyFileW CreateEventA LeaveCriticalSection TerminateProcess CreateFileW VirtualAlloc EnterCriticalSection lstrcmpiW lstrcatW GetCurrentThreadId DuplicateHandle GetTempPathA SuspendThread ResumeThread lstrcpyW SwitchToThread MapViewOfFile UnmapViewOfFile SetLastError lstrcmpiA OpenWaitableTimerA OpenMutexA WaitForMultipleObjects CreateMutexA ReleaseMutex CreateWaitableTimerA UnregisterWait TlsGetValue LoadLibraryExW TlsSetValue VirtualQuery VirtualProtect TlsAlloc GetProcAddress OpenEventA RemoveVectoredExceptionHandler AddVectoredExceptionHandler GetDriveTypeW GetLogicalDriveStringsW WideCharToMultiByte GetExitCodeProcess CreateProcessA CreateFileMappingA OpenFileMappingA LocalFree lstrcpynA GlobalLock GlobalUnlock Thread32First Thread32Next QueueUserAPC OpenThread CreateToolhelp32Snapshot CallNamedPipeA WaitNamedPipeA ConnectNamedPipe ReadFile GetOverlappedResult DisconnectNamedPipe FlushFileBuffers CreateNamedPipeA CancelIo GetSystemTime SleepEx LocalAlloc FreeLibrary RaiseException ExpandEnvironmentStringsW RemoveDirectoryW SetEndOfFile SetFilePointer FindNextFileW FindClose GetFileAttributesW SetFilePointerEx FindFirstFileW GetVersionExA

Sharing