gozi_ifsb | 0x000e0000000122f1-58[.]dat | Triage

Submit
Reports

Overview

overview

Static

static

0x000e0000...58.exe

windows7-x64

0x000e0000...58.exe

windows10-2004-x64

Sharing

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0x000e0000000122f1-58.exe

Resource

win7-20220901-en

gozi_ifsb 10103 banker trojan

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

0x000e0000000122f1-58.exe

Resource

win10v2004-20220812-en

gozi_ifsb 10103 banker trojan

windows10-2004-x64

11 signatures

150 seconds

General

Target

0x000e0000000122f1-58.dat
Size

37KB
MD5

b7ce4f9f6ecd85bb5edbb6964226fdb6
SHA1

12b28a42e960dfc522348eba37b00ea74a0df527
SHA256

bf5845a6b0df356338cc4ae53dd2cdefcb114bd95f351e55fd430cee5408ffeb
SHA512

1f5588d5b0816bbfc51394f434a9a80a96c68b66ca86a6a3cd53d64bf6a63751902c5f782a15522749231022c2695c6df7fbc604ae1d242f21554269f6d31e86
SSDEEP

768:7QLm41fM01vAoyRdq63goMWPXE2bE/JVMq2LATqeeAeOu2D2wqmLiuU:7L41fMSvVAdqlaPGhVMq2LpeReOb2Pmm

Score

10^/10

gozi_ifsb

Malware Config

Signatures

Gozi_ifsb family
gozi_ifsb

Files

0x000e0000000122f1-58.dat
.exe windows x86

1640d668d1471f340cbe565fe63522f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

_snwprintf
memset
NtQuerySystemInformation
_aulldiv

kernel32

GetModuleHandleA
GetLocaleInfoA
GetSystemDefaultUILanguage
HeapAlloc
HeapFree
WaitForSingleObject
Sleep
ExitThread
lstrlenW
GetLastError
VerLanguageNameA
GetExitCodeThread
CloseHandle
HeapCreate
HeapDestroy
GetCommandLineW
ExitProcess
SetLastError
TerminateThread
SleepEx
GetModuleFileNameW
CreateThread
OpenProcess
CreateEventA
GetLongPathNameW
GetVersion
GetCurrentProcessId
GetProcAddress
LoadLibraryA
VirtualProtect
MapViewOfFile
GetSystemTimeAsFileTime
CreateFileMappingW
QueueUserAPC

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

© 2018-2025

Terms | Privacy