Behavioral task
behavioral1
Sample
51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked.dll
Resource
win10v2004-20220901-en
General
-
Target
51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked
-
Size
283KB
-
MD5
30aea45bf0485a95a8cfa5254aa9e5d5
-
SHA1
e7e9483142105311a04dacdc19ac10e060735b44
-
SHA256
668ac0ef90e0db8dd33020335f43505d1afce803b7e659d51e3be2bdcc933c5f
-
SHA512
3b0e0a3a069af5676e56de0f9b934084290ded4144f7f5ba213d384f531550eb0b67b635f36097b8018d81462f151a827b8325f3edf148a839e0ce031179734b
-
SSDEEP
6144:09Rv3hOkTHNncBQtfUTqlalxR+u8dsiH6dGKGIyV3EeXiI610zyIckzRiAo:0r5HNtsTqglx5bHdL+39810zyIc5Ao
Malware Config
Extracted
gozi_ifsb
-
build
216881
Signatures
-
Gozi_ifsb family
Files
-
51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked.dll windows x86
e845fdc3a3816c1593a032c6c664669e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
sscanf
_memicmp
strncpy
memmove
memcmp
RtlRandomEx
ZwQueryInformationToken
ZwOpenProcess
ZwClose
ZwOpenProcessToken
ZwQueryInformationProcess
RtlNtStatusToDosError
NtQuerySystemInformation
strstr
sprintf
memcpy
_snprintf
_wcsupr
_strupr
wcscpy
memset
ZwQueryKey
RtlFreeUnicodeString
RtlUpcaseUnicodeString
wcstombs
RtlImageNtHeader
RtlAdjustPrivilege
mbstowcs
isxdigit
NtMapViewOfSection
NtUnmapViewOfSection
strcpy
NtCreateSection
_aulldiv
_allmul
_allshl
_alldiv
_chkstk
RtlUnwind
NtQueryVirtualMemory
kernel32
QueueUserWorkItem
SystemTimeToTzSpecificLocalTime
TerminateThread
IsBadReadPtr
SetFilePointerEx
SystemTimeToFileTime
GetModuleFileNameA
GetLocalTime
GetModuleFileNameW
FileTimeToSystemTime
CreateFileA
lstrlenA
HeapAlloc
HeapFree
WriteFile
lstrcatA
CreateDirectoryA
GetLastError
RemoveDirectoryA
LoadLibraryA
CloseHandle
DeleteFileA
lstrcpyA
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
SetEvent
GetTickCount
HeapDestroy
HeapCreate
SetWaitableTimer
CreateDirectoryW
GetCurrentThread
GetSystemTimeAsFileTime
GetWindowsDirectoryA
OpenProcess
Sleep
CopyFileW
CreateEventA
CreateFileW
lstrlenW
InterlockedExchange
GetModuleHandleA
lstrcatW
GetCurrentThreadId
DuplicateHandle
DeleteFileW
GetTempPathA
SuspendThread
ResumeThread
lstrcpyW
CreateThread
SwitchToThread
lstrcmpA
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
LeaveCriticalSection
SetLastError
lstrcmpiA
EnterCriticalSection
OpenWaitableTimerA
OpenMutexA
WaitForMultipleObjects
CreateMutexA
FileTimeToLocalFileTime
GetVersionExA
CreateWaitableTimerA
InitializeCriticalSection
UnregisterWait
TlsGetValue
LoadLibraryExW
TlsSetValue
VirtualAlloc
RegisterWaitForSingleObject
VirtualProtect
TlsAlloc
GetProcAddress
GetFileSize
GetDriveTypeW
GetLogicalDriveStringsW
WideCharToMultiByte
GetExitCodeProcess
CreateProcessA
CreateFileMappingA
OpenFileMappingA
LocalFree
lstrcpynA
GlobalLock
GlobalUnlock
Thread32First
Thread32Next
QueueUserAPC
OpenThread
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetSystemTime
RemoveVectoredExceptionHandler
SleepEx
AddVectoredExceptionHandler
OpenEventA
LocalAlloc
FreeLibrary
RaiseException
VirtualFree
GetCurrentProcessId
GetVersion
ExpandEnvironmentStringsW
FindNextFileW
RemoveDirectoryW
FindClose
GetTempFileNameA
GetFileAttributesW
SetEndOfFile
SetFilePointer
FindFirstFileW
ResetEvent
GetComputerNameW
DeleteCriticalSection
VirtualProtectEx
lstrcmpiW
ReleaseMutex
CreateToolhelp32Snapshot
iphlpapi
GetAdaptersAddresses
GetIpAddrTable
GetBestRoute
oleaut32
VariantInit
VariantClear
SysAllocString
SysFreeString
Sections
.text Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ