gozi_ifsb | 514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked

Sharing

Copy URL

Twitter E-mail

General

Target

514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked
Size

247KB
MD5

42bec6ebbf72c0c13f7d0430fdec6a83
SHA1

fe52ac86deecae98d7f9c452360a19c909b301ea
SHA256

a08b6bd2b9d190017e68c7d032065e6fe0f169fd9400e5589ffe5de82fcf3646
SHA512

cfb61d4f2a9041d7f55e74fd0b4a0c0df1612aa059b06e9be54064cefac25615ac082b16979c50b86f7ab5b62be52400a37a5f83543a88e18764c86299582c52
SSDEEP

6144:INDg0fYEB+SMqV8qlalvaRFhlRaPBGlwCAkuKdgN940OiB:IhB+SfV8qgliBloGlEpf

Score

10^/10

1000 gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1000

rastobona.com

artefaki.com

spamhouseanilingus.ru

gazitivaton.ru

Attributes

build
200000
exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi_ifsb family
gozi_ifsb

Files

514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked
.dll windows x86

3856a270c3ac6def1026a8a34e6f4829

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strncpy
memcmp
memmove
NtCreateSection
NtUnmapViewOfSection
NtMapViewOfSection
RtlRandomEx
ZwQueryInformationToken
ZwOpenProcess
ZwClose
ZwOpenProcessToken
ZwQueryInformationProcess
RtlNtStatusToDosError
NtQuerySystemInformation
isxdigit
memcpy
_wcsupr
_strupr
wcscpy
memset
ZwQueryKey
RtlFreeUnicodeString
RtlUpcaseUnicodeString
wcstombs
_snprintf
strcpy
sprintf
RtlImageNtHeader
RtlAdjustPrivilege
mbstowcs
strstr
sscanf
_memicmp
_allmul
_aulldiv
_allshl
_chkstk
_alldiv
RtlUnwind
NtQueryVirtualMemory

kernel32

IsBadReadPtr
FileTimeToLocalFileTime
VirtualProtectEx
lstrcmpiW
GetModuleFileNameA
GetLocalTime
GetModuleFileNameW
FileTimeToSystemTime
CreateRemoteThread
VirtualFree
CreateFileA
lstrlenA
HeapAlloc
HeapFree
WriteFile
lstrcatA
CreateDirectoryA
GetLastError
RemoveDirectoryA
LoadLibraryA
CloseHandle
DeleteFileA
lstrcpyA
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
SetEvent
GetTickCount
HeapDestroy
HeapCreate
SetWaitableTimer
CreateDirectoryW
GetCurrentThread
GetSystemTimeAsFileTime
GetWindowsDirectoryA
Sleep
CopyFileW
CreateEventA
CreateFileW
lstrlenW
lstrcatW
GetCurrentThreadId
DeleteFileW
GetTempPathA
SuspendThread
ResumeThread
lstrcpyW
CreateThread
SwitchToThread
lstrcmpA
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
GetComputerNameW
LeaveCriticalSection
SetLastError
lstrcmpiA
EnterCriticalSection
OpenWaitableTimerA
OpenMutexA
TerminateThread
CreateMutexA
ReleaseMutex
CreateWaitableTimerA
InitializeCriticalSection
UnregisterWait
LoadLibraryExW
InterlockedExchange
VirtualAlloc
RegisterWaitForSingleObject
GetModuleHandleA
VirtualProtect
GetProcAddress
GetFileSize
GetDriveTypeW
GetLogicalDriveStringsW
WideCharToMultiByte
GetExitCodeProcess
CreateProcessA
CreateFileMappingA
OpenFileMappingA
LocalFree
lstrcpynA
TlsGetValue
TlsSetValue
TlsAlloc
GlobalLock
GlobalUnlock
Thread32First
Thread32Next
GetCurrentProcessId
OpenThread
CreateToolhelp32Snapshot
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetSystemTime
RemoveVectoredExceptionHandler
SleepEx
AddVectoredExceptionHandler
OpenEventA
ResetEvent
LocalAlloc
FreeLibrary
RaiseException
GetVersion
OpenProcess
DeleteCriticalSection
ExpandEnvironmentStringsW
FindNextFileW
RemoveDirectoryW
FindClose
GetTempFileNameA
GetFileAttributesW
SetEndOfFile
SetFilePointer
FindFirstFileW
SystemTimeToTzSpecificLocalTime
SetFilePointerEx
WaitForMultipleObjects
QueueUserAPC

iphlpapi

GetAdaptersAddresses
GetIpAddrTable
GetBestRoute

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

3856a270c3ac6def1026a8a34e6f4829

Headers

File Characteristics

Imports

ntdll

kernel32

iphlpapi

oleaut32

Sections

.text Size: 208KB - Virtual size: 208KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 4KB - Virtual size: 5KB

.bss Size: 6KB - Virtual size: 5KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 208KB - Virtual size: 208KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 5KB

.bss
Size: 6KB - Virtual size: 5KB

.reloc
Size: 12KB - Virtual size: 12KB