gozi_ifsb | 4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4_unpacked_x64

Sharing

Copy URL

Twitter E-mail

General

Target

4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4_unpacked_x64
Size

359KB
MD5

012cfbbe670e099085223c89e86b771a
SHA1

889a7c1366eea7dbcfb0df549822b0948333936d
SHA256

f3c0cb53a4e88d97445b3276cea4e101b60535535ec6e620185f6d43e6604816
SHA512

8466aafa9bb52423e50c28e79a04908c5193afcebd2248b0c20ad21e3bdc301386b912a9538c44f4e62dbf57201347c921b99182aca02a05d01e10b083bfd445
SSDEEP

6144:Ac+0IiFwDDl+sMy2iW8REaezFLRlABdCK/stVhfNykn529o8ynqTkAP/fC:AX0IKwDDl7My9RE3zDlABdC5VJp29o81

Score

10^/10

gozi_ifsb

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
216887

Signatures

Gozi_ifsb family
gozi_ifsb

Files

4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4_unpacked_x64
.dll windows x64

48b69f0b43e51f4fec4b0c0013d88b4c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

strstr
sscanf
_memicmp
strncpy
memmove
memcmp
RtlRandomEx
ZwQueryInformationToken
ZwOpenProcess
ZwClose
ZwOpenProcessToken
ZwQueryInformationProcess
RtlNtStatusToDosError
NtQuerySystemInformation
isxdigit
strcpy
sprintf
memcpy
_snprintf
_wcsupr
_strupr
wcscpy
memset
ZwQueryKey
RtlFreeUnicodeString
RtlUpcaseUnicodeString
wcstombs
RtlImageNtHeader
RtlAdjustPrivilege
mbstowcs
NtMapViewOfSection
wcscat
NtCreateSection
NtUnmapViewOfSection
__C_specific_handler
__chkstk

kernel32

QueueUserWorkItem
SystemTimeToTzSpecificLocalTime
TerminateThread
IsBadReadPtr
SetFilePointerEx
GetModuleFileNameA
GetLocalTime
GetModuleFileNameW
FileTimeToSystemTime
CreateFileA
lstrlenA
HeapAlloc
HeapFree
WriteFile
lstrcatA
CreateDirectoryA
GetLastError
RemoveDirectoryA
LoadLibraryA
CloseHandle
DeleteFileA
lstrcpyA
HeapReAlloc
SetEvent
GetTickCount
HeapDestroy
HeapCreate
SetWaitableTimer
CreateDirectoryW
GetCurrentThread
GetSystemTimeAsFileTime
GetWindowsDirectoryA
OpenProcess
Sleep
CopyFileW
CreateEventA
CreateFileW
lstrlenW
GetModuleHandleA
lstrcatW
GetCurrentThreadId
DuplicateHandle
DeleteFileW
GetTempPathA
SuspendThread
ResumeThread
lstrcpyW
CreateThread
SwitchToThread
lstrcmpA
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
SetLastError
lstrcmpiA
ResetEvent
OpenWaitableTimerA
OpenMutexA
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
CreateWaitableTimerA
FileTimeToLocalFileTime
LeaveCriticalSection
EnterCriticalSection
UnregisterWait
TlsGetValue
LoadLibraryExW
TlsSetValue
VirtualAlloc
RegisterWaitForSingleObject
VirtualProtect
TlsAlloc
GetProcAddress
GetFileSize
GetDriveTypeW
GetLogicalDriveStringsW
WideCharToMultiByte
GetExitCodeProcess
CreateProcessA
CreateFileMappingA
OpenFileMappingA
LocalFree
lstrcpynA
GlobalLock
GlobalUnlock
Thread32First
Thread32Next
QueueUserAPC
CreateToolhelp32Snapshot
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetSystemTime
RemoveVectoredExceptionHandler
SleepEx
AddVectoredExceptionHandler
OpenEventA
LocalAlloc
FreeLibrary
RaiseException
VirtualFree
GetCurrentProcessId
GetVersion
ExpandEnvironmentStringsW
FindNextFileW
RemoveDirectoryW
FindClose
GetTempFileNameA
GetFileAttributesW
SetEndOfFile
SetFilePointer
FindFirstFileW
GetComputerNameW
DeleteCriticalSection
VirtualProtectEx
lstrcmpiW
InitializeCriticalSection
OpenThread

iphlpapi

GetAdaptersAddresses
GetIpAddrTable
GetBestRoute

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

Sections

.text
Size: 297KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

48b69f0b43e51f4fec4b0c0013d88b4c

Headers

File Characteristics

Imports

ntdll

kernel32

iphlpapi

oleaut32

Sections

.text Size: 297KB - Virtual size: 297KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 7KB - Virtual size: 9KB

.pdata Size: 10KB - Virtual size: 10KB

.bss Size: 6KB - Virtual size: 6KB

.reloc Size: 3KB - Virtual size: 4KB

.text
Size: 297KB - Virtual size: 297KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 7KB - Virtual size: 9KB

.pdata
Size: 10KB - Virtual size: 10KB

.bss
Size: 6KB - Virtual size: 6KB

.reloc
Size: 3KB - Virtual size: 4KB