gozi_ifsb | 056c73060f1553f213982a5bfb4d3535ef0594e1fcb70c8a67bc83e6b5d972c5

Sharing

Copy URL Twitter E-mail

General

Target
056c73060f1553f213982a5bfb4d3535ef0594e1fcb70c8a67bc83e6b5d972c5
Size 350KB
Sample221026-3wytzsaag5
SHA256 056c73060f1553f213982a5bfb4d3535ef0594e1fcb70c8a67bc83e6b5d972c5
MD5 3f65f241981377c60c4f96e43f2925c3
SHA1 6f11358676bc96c1062858739904f955996906f4
SHA512 a02f051946afddd0034db22539f73d5639a8e57f0c5c19fa355f1e198691f83fc7df95c208c4330838a84265b5aaba6eac72f698e6307455d8561f621b6d005d
SSDEEP 6144:n5gNwmDoctwXekY4no0zbbRzpBwmZm+72dCMKB7QNk3VcXaO:kknXekNoYJzLids7Ak3VEN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

1000 gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1000

Attributes

exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

056c73060f1553f213982a5bfb4d3535ef0594e1fcb70c8a67bc83e6b5d972c5

.exe 350KB

056c73060f1553f213982a5bfb4d3535ef0594e1fcb70c8a67bc83e6b5d972c5

IMPHASH 97e7dbe1f62d5f3ed19071d3a69aff1c
SHA256 056c73060f1553f213982a5bfb4d3535ef0594e1fcb70c8a67bc83e6b5d972c5
MD5 3f65f241981377c60c4f96e43f2925c3
SHA1 6f11358676bc96c1062858739904f955996906f4
SHA512 a02f051946afddd0034db22539f73d5639a8e57f0c5c19fa355f1e198691f83fc7df95c208c4330838a84265b5aaba6eac72f698e6307455d8561f621b6d005d
SSDEEP 6144:n5gNwmDoctwXekY4no0zbbRzpBwmZm+72dCMKB7QNk3VcXaO:kknXekNoYJzLids7Ak3VEN
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

4729

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

ZwQueryInformationProcess ZwOpenProcessToken memset NtQueryVirtualMemory RtlUnwind NtQuerySystemInformation RtlNtStatusToDosError ZwOpenProcess memcpy ZwQueryInformationToken ZwClose mbstowcs NtMapViewOfSection NtCreateSection NtUnmapViewOfSection RtlFreeUnicodeString RtlUpcaseUnicodeString

shlwapi

StrStrIA StrChrA StrChrW PathFindExtensionA PathCombineW StrTrimW PathFindExtensionW StrRChrA

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiEnumDeviceInfo

kernel32

SetFileAttributesW SetEvent lstrcpyA Sleep lstrlenW SetEndOfFile CreateEventA FlushFileBuffers FindNextFileA FindFirstFileA GetLastError lstrcmpiW HeapAlloc GetCommandLineW GetProcAddress SetWaitableTimer lstrcatW GetFileTime FindClose CompareFileTime WriteFile CreateProcessA ResetEvent HeapFree DeleteFileW CreateWaitableTimerA CreateFileW CreateDirectoryW lstrcatA lstrcpyW VirtualProtectEx ResumeThread SuspendThread lstrcmpA GetTempPathA ExitProcess GetModuleHandleA HeapCreate HeapDestroy CloseHandle GetSystemTimeAsFileTime CreateFileA ReadFile WaitForSingleObject SetFilePointer lstrlenA GetTickCount OpenProcess GetFileSize GetTempFileNameA CreateDirectoryA lstrcpynA ExpandEnvironmentStringsW ExpandEnvironmentStringsA LocalFree GetVersion GetLongPathNameW CreateRemoteThread VirtualAlloc lstrcmpiA GetModuleFileNameA GetCurrentProcessId SetLastError VirtualFree GetModuleFileNameW

user32

FindWindowA wsprintfW wsprintfA GetCursorInfo

advapi32

RegEnumKeyExA RegOpenKeyW RegDeleteValueW AllocateAndInitializeSid SetEntriesInAclA LookupPrivilegeValueA AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorA FreeSid SetSecurityInfo RegQueryValueExW GetSidSubAuthority GetSidSubAuthorityCount RegQueryValueExA OpenProcessToken RegSetValueExA RegOpenKeyA RegCreateKeyA GetTokenInformation RegSetValueExW RegCloseKey SetNamedSecurityInfoA GetSecurityInfo RegOpenKeyExA

shell32

ord92 ShellExecuteExW ShellExecuteW

ole32

CoUninitialize CoInitializeEx