Behavioral task
behavioral1
Sample
07658c673d6fef7c467c279eaacb5387b991cbdf82f0b5695a8d9117102db3fb_unpacked.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
07658c673d6fef7c467c279eaacb5387b991cbdf82f0b5695a8d9117102db3fb_unpacked.dll
Resource
win10v2004-20220812-en
General
-
Target
07658c673d6fef7c467c279eaacb5387b991cbdf82f0b5695a8d9117102db3fb_unpacked
-
Size
285KB
-
MD5
312ccaa9ff8f39d698c083fd3aabfd5c
-
SHA1
76248e2ddbd9b2b1084a08a86bcc19ac1e2731d9
-
SHA256
61619f607468718ff0d2bbae65a9f5b41226affc95d4ef59b6558e3e2c4ad467
-
SHA512
e7dd2c2724153c1146fbc3cb34ac7fb3d5a7ee1a800f3def99c685884346092354d7217c0a16939cf5b558e61bf2b1b3ed81b0534382c37691febc1bb42ec467
-
SSDEEP
6144:qpEmN0twjkjnSQKUb2iyBSvlXwu8dB1pvqlalMcDTcyyi:/E0CkjS0b7vvK1pvqgl7DTj
Malware Config
Extracted
gozi_ifsb
-
build
216861
Signatures
-
Gozi_ifsb family
Files
-
07658c673d6fef7c467c279eaacb5387b991cbdf82f0b5695a8d9117102db3fb_unpacked.dll windows x86
35212937cf992eb0dea0131f7c9437be
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
sprintf
isxdigit
strstr
sscanf
_memicmp
strncpy
memmove
memcmp
RtlRandomEx
ZwQueryInformationToken
ZwOpenProcess
ZwOpenProcessToken
strcpy
ZwQueryInformationProcess
NtQuerySystemInformation
wcscat
ZwClose
RtlNtStatusToDosError
NtUnmapViewOfSection
NtMapViewOfSection
memcpy
_snprintf
_wcsupr
_strupr
wcscpy
memset
ZwQueryKey
RtlFreeUnicodeString
RtlUpcaseUnicodeString
RtlImageNtHeader
wcstombs
RtlAdjustPrivilege
mbstowcs
strlen
wcslen
wcsncmp
NtCreateSection
_chkstk
_allmul
_aulldiv
_allshl
_alldiv
RtlUnwind
NtQueryVirtualMemory
kernel32
GetEnvironmentVariableW
ResetEvent
GetComputerNameW
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
TerminateThread
IsBadReadPtr
QueueUserWorkItem
FileTimeToLocalFileTime
SystemTimeToFileTime
MultiByteToWideChar
CreateFileA
lstrlenA
HeapAlloc
HeapFree
WriteFile
lstrcatA
CreateDirectoryA
GetLastError
RemoveDirectoryA
LoadLibraryA
CloseHandle
DeleteFileA
lstrcpyA
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
SetEvent
GetTickCount
HeapDestroy
HeapCreate
SetWaitableTimer
CreateDirectoryW
GetCurrentThread
GetSystemTimeAsFileTime
GetWindowsDirectoryA
OpenProcess
Sleep
CopyFileW
CreateEventA
CreateFileW
lstrlenW
InterlockedExchange
GetModuleHandleA
lstrcatW
GetCurrentThreadId
DuplicateHandle
DeleteFileW
GetTempPathA
SuspendThread
ResumeThread
lstrcpyW
CreateThread
SwitchToThread
lstrcmpA
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
LeaveCriticalSection
SetLastError
lstrcmpiA
EnterCriticalSection
OpenWaitableTimerA
OpenMutexA
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
CreateWaitableTimerA
InitializeCriticalSection
SetEnvironmentVariableW
TlsGetValue
LoadLibraryExW
TlsSetValue
VirtualAlloc
RegisterWaitForSingleObject
VirtualProtect
TlsAlloc
GetProcAddress
GetFileSize
GetDriveTypeW
GetLogicalDriveStringsW
WideCharToMultiByte
GetExitCodeProcess
CreateProcessA
CreateFileMappingA
OpenFileMappingA
LocalFree
lstrcpynA
GlobalLock
GlobalUnlock
Thread32First
Thread32Next
QueueUserAPC
OpenThread
CreateToolhelp32Snapshot
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetSystemTime
RemoveVectoredExceptionHandler
SleepEx
AddVectoredExceptionHandler
OpenEventA
LocalAlloc
FreeLibrary
RaiseException
QueryPerformanceFrequency
GetModuleFileNameA
GetLocalTime
GetModuleFileNameW
FileTimeToSystemTime
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetVersion
DeleteCriticalSection
ExpandEnvironmentStringsW
FindNextFileW
RemoveDirectoryW
FindClose
GetTempFileNameA
GetFileAttributesW
SetEndOfFile
SetFilePointer
FindFirstFileW
VirtualProtectEx
LoadLibraryW
lstrcmpiW
UnregisterWait
DisconnectNamedPipe
iphlpapi
GetAdaptersAddresses
GetIpAddrTable
GetBestRoute
oleaut32
VariantInit
VariantClear
SysAllocString
SysFreeString
Sections
.text Size: 237KB - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ