gozi_ifsb | 3237ec73a4f16533fd2c3fb92b3caf43e42b5c9f11d61a5f8576a86c478f0b55_unpacked

Sharing

Copy URL

Twitter E-mail

General

Target

3237ec73a4f16533fd2c3fb92b3caf43e42b5c9f11d61a5f8576a86c478f0b55_unpacked
Size

108KB
MD5

3dfa4f44613b1ad60b9d592a3efd7289
SHA1

761848e7a9b9ba4f02c8cd45076e4f269a674e70
SHA256

d1b4045990964610141800df6c538a05d00aadb8b28390d91de28aa5b8ac90af
SHA512

983f1165ca7d36f860cbb111ad846618ff6039da24d2180434b2e1f89be80937e93e967f64922fbeebdfa790b8532c21a8880fbb37ffcea646ff8f72042f3de6
SSDEEP

3072:3l6Rrc/z9Lh39PvrYnD2qlaleOMEKlKg5fUny:cxcb9Lh5sCqlalevSg3

Score

10^/10

1000 gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1000

tandlawsnative.su/ne_utils/front/xxx

leendeilco-1000.su/ne_utils/front/xxx

princlegislative.su/ne_utils/front/xxx

Attributes

exe_type
worker

rsa_pubkey.plain

serpent.plain

Signatures

Gozi_ifsb family
gozi_ifsb

Files

3237ec73a4f16533fd2c3fb92b3caf43e42b5c9f11d61a5f8576a86c478f0b55_unpacked
.dll windows x86

a0deb5ee7cc9322a0854ead28e744a61

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtCreateSection
NtMapViewOfSection
sprintf
ZwQueryInformationToken
ZwOpenProcess
ZwClose
RtlFreeUnicodeString
ZwOpenProcessToken
RtlConvertSidToUnicodeString
strcpy
NtGetContextThread
ZwQueryInformationProcess
RtlNtStatusToDosError
NtSetContextThread
wcsncat
memcpy
_wcsupr
_strupr
strstr
wcscpy
memset
wcstombs
RtlAdjustPrivilege
mbstowcs
NtUnmapViewOfSection
_aulldiv
_allmul
RtlUnwind
NtQueryVirtualMemory

kernel32

GlobalLock
GetThreadContext
GetVersionExA
VerLanguageNameW
GetLocaleInfoW
GetComputerNameW
QueueUserWorkItem
WriteProcessMemory
GetModuleFileNameA
GetLocalTime
VirtualAllocEx
VirtualAlloc
CreateFileA
lstrlenA
HeapAlloc
HeapFree
WriteFile
lstrcatA
CreateDirectoryA
GetLastError
RemoveDirectoryA
LoadLibraryA
CloseHandle
DeleteFileA
lstrcpyA
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
SetEvent
GetTickCount
HeapDestroy
HeapCreate
SetWaitableTimer
GetCurrentProcess
CreateDirectoryW
GetCurrentThread
GetSystemTimeAsFileTime
GetWindowsDirectoryA
Sleep
CopyFileW
CreateEventA
lstrlenW
InterlockedExchange
GetProcAddress
GetModuleHandleA
lstrcatW
GetCurrentThreadId
DeleteFileW
GetCurrentProcessId
GetTempPathA
SuspendThread
ResumeThread
lstrcpyW
CreateThread
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
CreateWaitableTimerA
SwitchToThread
UnregisterWait
LoadLibraryExW
SetLastError
RegisterWaitForSingleObject
GetFileSize
GetDriveTypeW
GetLogicalDriveStringsW
GetFileAttributesA
GetExitCodeProcess
GetFileAttributesW
CreateProcessA
CreateFileW
GetTempFileNameA
CreateFileMappingA
OpenFileMappingA
lstrcpynA
ReadProcessMemory
GlobalUnlock
lstrcmpiA
Thread32First
Thread32Next
QueueUserAPC
OpenThread
CreateToolhelp32Snapshot
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetSystemTime
lstrcmpW
SleepEx
InitializeCriticalSection
ResetEvent
SetEndOfFile
LocalAlloc
LocalFree
FreeLibrary
RaiseException
OpenProcess
CreateRemoteThread
VirtualFree
GetSystemDefaultUILanguage
GetVersion
DeleteCriticalSection
VirtualProtect
lstrcmpA
ExpandEnvironmentStringsW
FindNextFileW
FindNextFileA
FindClose
FindFirstFileA
ExpandEnvironmentStringsA
SetFilePointer
FindFirstFileW
VirtualProtectEx

Exports

Exports

CreateProcessNotify

Sections

.text
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

a0deb5ee7cc9322a0854ead28e744a61

Headers

File Characteristics

Imports

ntdll

kernel32

Exports

Exports

Sections

.text Size: 83KB - Virtual size: 83KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 3KB - Virtual size: 3KB

.bss Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 83KB - Virtual size: 83KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 3KB - Virtual size: 3KB

.bss
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 8KB