0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked_x64

Reason

config extraction: missing cfgextr callback for rule "Gozi_FJ_loader"

General

Target
0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked_x64
Size 112KB
Sample221026-3w34psaahk
SHA256 deb88e78eb54a0297cd573231a8e0ddfadfced68ba4fbdc3c8ed2e035c52ed30
MD5 1d9eb92dee117a6c39a538b2f2c50daa
SHA1 4310f5f11fb1259a6d50140959538d202d4aeca0
SHA512 1b80694d44e861e1a2b8ecdae90a7c0dd88d0b38e6155f72e55d14cf1f4ff86c79277104f9ced8714f44dfac66978153a36baf7c23faf5fc1c0b1c846868098c
SSDEEP 3072:ga3CJcJDyt3l2bOlxBuxNtTWNxltoTDP4BtKu9fj1LmbT:gayJcJfOvBuxqNxcTcK7n
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked_x64

.dll 112KB

0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked_x64

IMPHASH f02a11a9b0977c8f6fdefcc1fe9eceea
SHA256 deb88e78eb54a0297cd573231a8e0ddfadfced68ba4fbdc3c8ed2e035c52ed30
MD5 1d9eb92dee117a6c39a538b2f2c50daa
SHA1 4310f5f11fb1259a6d50140959538d202d4aeca0
SHA512 1b80694d44e861e1a2b8ecdae90a7c0dd88d0b38e6155f72e55d14cf1f4ff86c79277104f9ced8714f44dfac66978153a36baf7c23faf5fc1c0b1c846868098c
SSDEEP 3072:ga3CJcJDyt3l2bOlxBuxNtTWNxltoTDP4BtKu9fj1LmbT:gayJcJfOvBuxqNxcTcK7n
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

5724

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

NtSetContextThread ZwQueryInformationProcess NtGetContextThread ZwOpenProcessToken ZwOpenProcess ZwQueryInformationToken sprintf NtCreateSection ZwClose NtUnmapViewOfSection NtMapViewOfSection RtlNtStatusToDosError strstr _strupr strcpy wcstombs mbstowcs wcscpy memcpy RtlAdjustPrivilege memset __C_specific_handler

kernel32

DeleteCriticalSection VirtualProtect GetModuleFileNameA VirtualAllocEx VirtualAlloc OpenProcess CreateRemoteThread VirtualFree SetFilePointer GetVersion GetComputerNameA CreateProcessW ResumeThread SuspendThread CreateFileA lstrlenA HeapAlloc HeapFree WriteFile lstrcatA CreateDirectoryA GetLastError RemoveDirectoryA LoadLibraryA CloseHandle DeleteFileA lstrcpyA HeapReAlloc SetEvent GetTickCount HeapDestroy HeapCreate GetCurrentThreadId CreateDirectoryW GetWindowsDirectoryA Sleep CopyFileW lstrlenW GetModuleHandleA lstrcatW DeleteFileW GetTempPathA MapViewOfFile UnmapViewOfFile SetWaitableTimer GetCurrentProcess CreateEventA LeaveCriticalSection lstrcmpiA EnterCriticalSection WaitForMultipleObjects CreateMutexA ReleaseMutex CreateWaitableTimerA UnregisterWait LoadLibraryExW WaitForSingleObject SetLastError RegisterWaitForSingleObject GetFileSize FindFirstFileW GetDriveTypeW GetLogicalDriveStringsW InitializeCriticalSection GetFileAttributesA GetFileAttributesW CreateProcessA CreateFileW FindFirstFileA GetTempFileNameA FindClose CreateFileMappingA FindNextFileA FindNextFileW QueueUserWorkItem OpenFileMappingA CreateThread lstrcpynA lstrcmpA GlobalLock GlobalUnlock Thread32First Thread32Next GetProcAddress QueueUserAPC OpenThread CreateToolhelp32Snapshot CallNamedPipeA WaitNamedPipeA ConnectNamedPipe ReadFile GetOverlappedResult DisconnectNamedPipe FlushFileBuffers CreateNamedPipeA CancelIo GetCurrentProcessId GetSystemTime lstrcmpW SleepEx ResetEvent LocalAlloc LocalFree FreeLibrary RaiseException GetThreadContext SwitchToThread ReadProcessMemory VirtualProtectEx WriteProcessMemory

Sharing

Errors

General

Malware Config

Signatures

File Explorer

0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked_x64

ntdll

kernel32