gozi_ifsb | 51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked_dropper

Sharing

Copy URL

Twitter E-mail

General

Target

51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked_dropper
Size

424KB
MD5

15678528c7da011fbfd152f46883bf26
SHA1

f1d1a0bb8e3d4242203b954723948a89ca21434a
SHA256

51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8
SHA512

3e2d3c4f9ec19585ddb552156ed1514cfa186fd77507e69ae8c8e95d13fe0633ba5f81553499fcedfdccf636d0a643817d12602d0ac6a73f9ded11a82928e8fd
SSDEEP

6144:4K6Loa9O0GrfwCgYzAqtHj+YmyuYdrlRxmjIY5KUrPotYWieqG+cPAN4/HrcLLG4:8PO0CwCgX0ZmyvNLUrAhiHNSVgLLIC

Score

10^/10

gozi_ifsb

Malware Config

Signatures

Gozi_ifsb family
gozi_ifsb

Files

51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked_dropper
.exe windows x86

50a03aab3f688501f35c5c64137234fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlNtStatusToDosError
memset
NtUnmapViewOfSection
NtMapViewOfSection
memcpy
ZwClose
NtCreateSection
mbstowcs
ZwOpenProcessToken
ZwOpenProcess
ZwQueryInformationToken
NtQuerySystemInformation
RtlFreeUnicodeString
ZwQueryInformationProcess
RtlUnwind
RtlUpcaseUnicodeString
NtQueryVirtualMemory

shlwapi

StrRChrA
PathFindExtensionW
PathFindFileNameW
StrChrA
PathCombineW
StrStrIA
StrTrimW
StrChrW
PathFindFileNameA
PathFindExtensionA

setupapi

SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA

kernel32

SetEvent
GetTickCount
Sleep
HeapFree
GetExitCodeProcess
CreateProcessA
lstrlenW
GetLastError
GetProcAddress
ResetEvent
LoadLibraryA
lstrcmpiW
lstrcatW
DeleteFileW
CreateWaitableTimerA
SetFileAttributesW
SetWaitableTimer
HeapAlloc
GetModuleHandleA
HeapCreate
HeapDestroy
GetCommandLineW
ExitProcess
CloseHandle
ReadFile
WaitForSingleObject
CreateFileA
CreateEventA
LocalFree
CreateThread
GetCurrentThreadId
IsWow64Process
GetVersionExW
TerminateThread
InitializeCriticalSection
GetCurrentProcess
lstrcmpA
GetTempPathA
GetTempFileNameA
EnterCriticalSection
CreateDirectoryA
LeaveCriticalSection
GetFileSize
lstrcpynA
GetModuleFileNameA
VirtualAlloc
OpenProcess
VirtualProtectEx
SuspendThread
ResumeThread
GetLongPathNameW
GetVersion
GetCurrentProcessId
lstrlenA
ExpandEnvironmentStringsA
lstrcatA
lstrcpyA
ExpandEnvironmentStringsW
lstrcmpiA
SetEndOfFile
CompareFileTime
CreateDirectoryW
WriteFile
CreateFileW
FlushFileBuffers
FindFirstFileA
FindClose
FindNextFileA
GetFileTime
lstrcpyW
SetFilePointer
VirtualFree
GetModuleFileNameW
SetLastError
FreeLibrary

user32

wsprintfW
DispatchMessageW
DefWindowProcW
EndMenu
SendMessageW
GetClassWord
SetWindowsHookExW
CreateWindowExW
AppendMenuA
CreatePopupMenu
SetClassLongW
TrackPopupMenuEx
SetWinEventHook
RegisterClassExW
TranslateMessage
CallNextHookEx
PostMessageW
GetMessageW
DestroyWindow
wsprintfA
GetCursorInfo

advapi32

OpenProcessToken
RegDeleteValueW
RegEnumKeyExA
RegOpenKeyW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegSetValueExW
RegOpenKeyA
RegCreateKeyA
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCloseKey
RegOpenKeyExA
RegQueryValueExW
RegSetValueExA
RegQueryValueExA

shell32

ord92
ShellExecuteW
ShellExecuteExW

ole32

CoUninitialize
CoInitializeEx

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 367KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50a03aab3f688501f35c5c64137234fd

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

setupapi

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 3KB

.bss Size: 2KB - Virtual size: 1KB

.rsrc Size: 367KB - Virtual size: 368KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 3KB

.bss
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 367KB - Virtual size: 368KB