gozi_ifsb | 07658c673d6fef7c467c279eaacb5387b991cbdf82f0b5695a8d9117102db3fb_unpacked

General

Target
07658c673d6fef7c467c279eaacb5387b991cbdf82f0b5695a8d9117102db3fb_unpacked
Size 285KB
Sample221026-3wz22saagp
SHA256 61619f607468718ff0d2bbae65a9f5b41226affc95d4ef59b6558e3e2c4ad467
MD5 312ccaa9ff8f39d698c083fd3aabfd5c
SHA1 76248e2ddbd9b2b1084a08a86bcc19ac1e2731d9
SHA512 e7dd2c2724153c1146fbc3cb34ac7fb3d5a7ee1a800f3def99c685884346092354d7217c0a16939cf5b558e61bf2b1b3ed81b0534382c37691febc1bb42ec467
SSDEEP 6144:qpEmN0twjkjnSQKUb2iyBSvlXwu8dB1pvqlalMcDTcyyi:/E0CkjS0b7vvK1pvqgl7DTj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
216861

Signatures

Gozi_ifsb family
gozi_ifsb

File Explorer

07658c673d6fef7c467c279eaacb5387b991cbdf82f0b5695a8d9117102db3fb_unpacked

.dll 285KB

07658c673d6fef7c467c279eaacb5387b991cbdf82f0b5695a8d9117102db3fb_unpacked

IMPHASH 35212937cf992eb0dea0131f7c9437be
SHA256 61619f607468718ff0d2bbae65a9f5b41226affc95d4ef59b6558e3e2c4ad467
MD5 312ccaa9ff8f39d698c083fd3aabfd5c
SHA1 76248e2ddbd9b2b1084a08a86bcc19ac1e2731d9
SHA512 e7dd2c2724153c1146fbc3cb34ac7fb3d5a7ee1a800f3def99c685884346092354d7217c0a16939cf5b558e61bf2b1b3ed81b0534382c37691febc1bb42ec467
SSDEEP 6144:qpEmN0twjkjnSQKUb2iyBSvlXwu8dB1pvqlalMcDTcyyi:/E0CkjS0b7vvK1pvqgl7DTj
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

5190

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

sprintf isxdigit strstr sscanf _memicmp strncpy memmove memcmp RtlRandomEx ZwQueryInformationToken ZwOpenProcess ZwOpenProcessToken strcpy ZwQueryInformationProcess NtQuerySystemInformation wcscat ZwClose RtlNtStatusToDosError NtUnmapViewOfSection NtMapViewOfSection memcpy _snprintf _wcsupr _strupr wcscpy memset ZwQueryKey RtlFreeUnicodeString RtlUpcaseUnicodeString RtlImageNtHeader wcstombs RtlAdjustPrivilege mbstowcs strlen wcslen wcsncmp NtCreateSection _chkstk _allmul _aulldiv _allshl _alldiv RtlUnwind NtQueryVirtualMemory

kernel32

GetEnvironmentVariableW ResetEvent GetComputerNameW SetFilePointerEx SystemTimeToTzSpecificLocalTime TerminateThread IsBadReadPtr QueueUserWorkItem FileTimeToLocalFileTime SystemTimeToFileTime MultiByteToWideChar CreateFileA lstrlenA HeapAlloc HeapFree WriteFile lstrcatA CreateDirectoryA GetLastError RemoveDirectoryA LoadLibraryA CloseHandle DeleteFileA lstrcpyA HeapReAlloc InterlockedIncrement InterlockedDecrement SetEvent GetTickCount HeapDestroy HeapCreate SetWaitableTimer CreateDirectoryW GetCurrentThread GetSystemTimeAsFileTime GetWindowsDirectoryA OpenProcess Sleep CopyFileW CreateEventA CreateFileW lstrlenW InterlockedExchange GetModuleHandleA lstrcatW GetCurrentThreadId DuplicateHandle DeleteFileW GetTempPathA SuspendThread ResumeThread lstrcpyW CreateThread SwitchToThread lstrcmpA MapViewOfFile UnmapViewOfFile WaitForSingleObject LeaveCriticalSection SetLastError lstrcmpiA EnterCriticalSection OpenWaitableTimerA OpenMutexA WaitForMultipleObjects CreateMutexA ReleaseMutex CreateWaitableTimerA InitializeCriticalSection SetEnvironmentVariableW TlsGetValue LoadLibraryExW TlsSetValue VirtualAlloc RegisterWaitForSingleObject VirtualProtect TlsAlloc GetProcAddress GetFileSize GetDriveTypeW GetLogicalDriveStringsW WideCharToMultiByte GetExitCodeProcess CreateProcessA CreateFileMappingA OpenFileMappingA LocalFree lstrcpynA GlobalLock GlobalUnlock Thread32First Thread32Next QueueUserAPC OpenThread CreateToolhelp32Snapshot CallNamedPipeA WaitNamedPipeA ConnectNamedPipe ReadFile GetOverlappedResult FlushFileBuffers CreateNamedPipeA CancelIo GetSystemTime RemoveVectoredExceptionHandler SleepEx AddVectoredExceptionHandler OpenEventA LocalAlloc FreeLibrary RaiseException QueryPerformanceFrequency GetModuleFileNameA GetLocalTime GetModuleFileNameW FileTimeToSystemTime VirtualFree QueryPerformanceCounter GetCurrentProcessId GetVersion DeleteCriticalSection ExpandEnvironmentStringsW FindNextFileW RemoveDirectoryW FindClose GetTempFileNameA GetFileAttributesW SetEndOfFile SetFilePointer FindFirstFileW VirtualProtectEx LoadLibraryW lstrcmpiW UnregisterWait DisconnectNamedPipe

iphlpapi

GetAdaptersAddresses GetIpAddrTable GetBestRoute

oleaut32

VariantInit VariantClear SysAllocString SysFreeString

Sharing