gozi_ifsb | a55d17e63fe5cd059359865c49b57f144245af936118cf7757a6e6ac28d645d2

Sharing

Copy URL Twitter E-mail

General

Target
a55d17e63fe5cd059359865c49b57f144245af936118cf7757a6e6ac28d645d2
Size 275KB
Sample221011-2fcfdahcg4
SHA256 a55d17e63fe5cd059359865c49b57f144245af936118cf7757a6e6ac28d645d2
MD5 686f5d3bd92ee9073621f952d5361a00
SHA1 f8e870214e59b48657e7e53b124c641e9eb1149f
SHA512 e885ff035dc2802b9c705254e9b4469311ea7cae4c28b8c4b10a227e71013b248eee64fa28b4b515e68676b4b95c777eaf4ce673ce7adf75f2cc60d4725185cd
SSDEEP 6144:BXnvThU/Ln3RyTM5nSOEt5zpaiRhcuGE07v6+uMHWzIH:RnvdVQ3wNxRhTKj6oHZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi_ifsb

Malware Config

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

a55d17e63fe5cd059359865c49b57f144245af936118cf7757a6e6ac28d645d2

.exe 275KB

a55d17e63fe5cd059359865c49b57f144245af936118cf7757a6e6ac28d645d2

IMPHASH c1723e7036e1a4eba5a01a73e3b94fe0
SHA256 a55d17e63fe5cd059359865c49b57f144245af936118cf7757a6e6ac28d645d2
MD5 686f5d3bd92ee9073621f952d5361a00
SHA1 f8e870214e59b48657e7e53b124c641e9eb1149f
SHA512 e885ff035dc2802b9c705254e9b4469311ea7cae4c28b8c4b10a227e71013b248eee64fa28b4b515e68676b4b95c777eaf4ce673ce7adf75f2cc60d4725185cd
SSDEEP 6144:BXnvThU/Ln3RyTM5nSOEt5zpaiRhcuGE07v6+uMHWzIH:RnvdVQ3wNxRhTKj6oHZ
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

110592

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress lstrcmpiA FreeLibrary GetModuleFileNameA lstrcpyA lstrlenA lstrcatA GetTempPathA LoadLibraryA CloseHandle CreateDirectoryA GetFileAttributesA SetEnvironmentVariableA WideCharToMultiByte MultiByteToWideChar GetLogicalDrives GetFullPathNameA GetTimeZoneInformation GetDriveTypeA ReadFile SetCurrentDirectoryA GetLastError VirtualAlloc VirtualFree GetFileType GetStdHandle UnhandledExceptionFilter RtlUnwind ExitProcess GetCPInfo GetOEMCP GetACP GetVersion GetCommandLineA GetEnvironmentStrings GlobalFree GlobalLock GlobalAlloc GlobalUnlock GetCurrentDirectoryA SetFilePointer DeleteFileA CreateFileA lstrcmpA lstrcpynA GlobalReAlloc GetStartupInfoA FileTimeToLocalFileTime SetFileAttributesA FileTimeToSystemTime WriteFile FindClose FindFirstFileA DosDateTimeToFileTime SetFileTime LocalFileTimeToFileTime GetModuleHandleA

user32

MessageBoxA PostQuitMessage DefWindowProcA GetMessageA IsDialogMessageA DispatchMessageA TranslateMessage PostMessageA LoadStringA GetSystemMetrics SetWindowTextA SetDlgItemTextA UpdateWindow GetWindowRect SetWindowPos GetDC OemToCharA wsprintfA SetCursor GetActiveWindow ReleaseDC LoadIconA LoadCursorA RegisterClassA CreateWindowExA GetSysColor CreateDialogParamA IsWindow

gdi32

DeleteObject CreateSolidBrush GetStockObject SetBkMode SetBkColor GetBkColor

Name

.text

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

�e�JJ_

Size

222KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE