gozi_ifsb | 5cb0000[.]dll[.]exe

General

Target
5cb0000.dll.exe
Size 228KB
Sample220927-net25sdcg6
SHA256 555df9df7ab7a1edf7764add9ff88b1266a078d48ee1cc00f21f0131a6b30b84
MD5 9dd50345a80bdc7bf873887c458bdc6f
SHA1 280a8fdbcc8ca09090ac12175b54668e7d2a9230
SHA512 7900a221d9a2c5e679e3ccaec94295051635311fc745138f569462e01c78304ff5ccf753f1319b5a998ebf38abb55649861fb3a597c4cf8d61864570471fe41b
SSDEEP 6144:XlDosEPR66q9KgylInd6oqA/wD5znFoc:tUPR6D9KDInd6oqA/wVF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

7777 gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

7777

C2

trackingg2-protectioon.cdn4.mozilla.net
109.230.199.185
trackingg3-protectioon.cdn5.mozilla.net
185.212.44.249
trackingg4-protectioon.cdn5.mozilla.net
194.76.225.37
trackingg5-protectioon.cdn1.mozilla.net
194.76.224.181
trackingg-protectioon.cdn1.mozilla.net
194.76.225.164
trackingg3-protectioon.cdn6.mozilla.net
185.158.251.205
trackingg-protectioon.cdn2.mozilla.net
185.189.149.216
trackingg5-protectioon.cdn3.mozilla.net
185.158.249.54
trackingg-protectioon.cdn4.mozilla.net
185.212.44.130
trackingg1-protectioon.cdn5.mozilla.net
37.10.71.83
trackinggs-trackingg-protectioon.cdn4.mozilla.net
trackingg-protectioon.cdn5.mozilla.net

Attributes

base_path
/fonts/
exe_type
worker
extension
.bak
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

5cb0000.dll.exe

.dll 228KB

5cb0000.dll.exe

IMPHASH 81de4ee1071a8320787d7c9e149ace7f
SHA256 555df9df7ab7a1edf7764add9ff88b1266a078d48ee1cc00f21f0131a6b30b84
MD5 9dd50345a80bdc7bf873887c458bdc6f
SHA1 280a8fdbcc8ca09090ac12175b54668e7d2a9230
SHA512 7900a221d9a2c5e679e3ccaec94295051635311fc745138f569462e01c78304ff5ccf753f1319b5a998ebf38abb55649861fb3a597c4cf8d61864570471fe41b
SSDEEP 6144:XlDosEPR66q9KgylInd6oqA/wD5znFoc:tUPR6D9KDInd6oqA/wVF
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

44448

Magic Number

523

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ZwOpenProcess ZwQueryInformationToken NtSetInformationProcess sprintf ZwOpenProcessToken strcpy ZwQueryInformationProcess RtlNtStatusToDosError NtQuerySystemInformation NtQueryInformationThread _wcsupr memmove wcscpy _snprintf mbstowcs ZwQueryKey NtResumeProcess RtlFreeUnicodeString RtlUpcaseUnicodeString NtSuspendProcess wcstombs RtlAdjustPrivilege memset _strupr _snwprintf memcpy RtlImageNtHeader ZwClose __C_specific_handler __chkstk RegisterWaitForSingleObject VirtualProtectEx FileTimeToLocalFileTime CreateFileMappingW GetModuleFileNameA GetModuleFileNameW QueryPerformanceFrequency GetLocalTime FileTimeToSystemTime GetComputerNameExA GetComputerNameW QueryPerformanceCounter GetTempFileNameA CreateThread TerminateThread GetCurrentProcessId GetVersion DeleteCriticalSection HeapAlloc HeapFree WaitForSingleObject ExitThread lstrlenW GetLastError ResetEvent CloseHandle DeleteFileW CreateFileA lstrlenA WriteFile lstrcatA CreateDirectoryA RemoveDirectoryA LoadLibraryA DeleteFileA lstrcpyA HeapReAlloc SetEvent GetSystemTimeAsFileTime HeapDestroy HeapCreate GetModuleHandleA ExitProcess GetFileSize lstrcmpA SetWaitableTimer CreateDirectoryW GetTickCount GetCurrentThread VirtualFree GetWindowsDirectoryA GetCommandLineA InitializeCriticalSection OpenProcess Sleep CopyFileW CreateEventA LeaveCriticalSection TerminateProcess CreateFileW VirtualAlloc EnterCriticalSection lstrcmpiW lstrcatW GetCurrentThreadId DuplicateHandle GetTempPathA SuspendThread ResumeThread lstrcpyW SwitchToThread MapViewOfFile UnmapViewOfFile SetLastError lstrcmpiA OpenWaitableTimerA OpenMutexA WaitForMultipleObjects CreateMutexA ReleaseMutex CreateWaitableTimerA UnregisterWait TlsGetValue LoadLibraryExW TlsSetValue VirtualQuery VirtualProtect TlsAlloc GetProcAddress OpenEventA RemoveVectoredExceptionHandler AddVectoredExceptionHandler GetDriveTypeW GetLogicalDriveStringsW WideCharToMultiByte GetExitCodeProcess CreateProcessA CreateFileMappingA OpenFileMappingA LocalFree lstrcpynA GlobalLock GlobalUnlock Thread32First Thread32Next QueueUserAPC OpenThread CreateToolhelp32Snapshot CallNamedPipeA WaitNamedPipeA ConnectNamedPipe ReadFile GetOverlappedResult DisconnectNamedPipe FlushFileBuffers CreateNamedPipeA CancelIo GetSystemTime SleepEx LocalAlloc FreeLibrary RaiseException ExpandEnvironmentStringsW RemoveDirectoryW SetEndOfFile SetFilePointer FindNextFileW FindClose GetFileAttributesW SetFilePointerEx FindFirstFileW GetVersionExA

Sharing