Behavioral task
behavioral1
Sample
51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked_x64.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked_x64.dll
Resource
win10v2004-20220812-en
General
-
Target
51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked_x64
-
Size
375KB
-
MD5
215ab06e4b1fc675de00cf2cf7503bb7
-
SHA1
6e7316ce894902cd7f174faeaaa708e4ae6983ee
-
SHA256
95921f6bde5e4d71fd4308822db46ce46b646d863037f89f236da7f0337c57d4
-
SHA512
80457c66ad719bd23437a3cd295345624409e5ab8681f3bc098b3455e068fcfe30c5195360d9eee7a4c7d9f458093ee1e0833ae8d945031246ddabf5576fb61c
-
SSDEEP
6144:Uk7CHLMnP9oa639GOQXiyuopjCHLC+y5YUBu+Vo0IfBpXfK:UoCrMnP9oa8GRX2opjCNyY+Vo0IfBJK
Malware Config
Extracted
gozi_ifsb
-
build
216881
Signatures
-
Gozi_ifsb family
Files
-
51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked_x64.dll windows x64
a545377d4fed090386c61dee5a1b4868
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
sscanf
_memicmp
strncpy
memmove
memcmp
strstr
RtlRandomEx
ZwQueryInformationToken
ZwOpenProcess
ZwClose
ZwOpenProcessToken
ZwQueryInformationProcess
NtResumeProcess
RtlNtStatusToDosError
NtQuerySystemInformation
NtSuspendProcess
sprintf
memcpy
_snprintf
_wcsupr
_strupr
wcscpy
memset
ZwQueryKey
RtlFreeUnicodeString
RtlUpcaseUnicodeString
wcstombs
RtlImageNtHeader
RtlAdjustPrivilege
mbstowcs
isxdigit
NtMapViewOfSection
NtUnmapViewOfSection
strcpy
NtCreateSection
__C_specific_handler
__chkstk
kernel32
QueueUserWorkItem
SystemTimeToTzSpecificLocalTime
IsBadReadPtr
SetFilePointerEx
GetVersionExW
TerminateThread
SystemTimeToFileTime
GetModuleFileNameA
GetLocalTime
CreateFileA
lstrlenA
HeapAlloc
HeapFree
WriteFile
lstrcatA
CreateDirectoryA
GetLastError
RemoveDirectoryA
LoadLibraryA
CloseHandle
DeleteFileA
lstrcpyA
HeapReAlloc
SetEvent
GetTickCount
HeapDestroy
HeapCreate
SetWaitableTimer
CreateDirectoryW
GetCurrentThread
GetSystemTimeAsFileTime
GetWindowsDirectoryA
OpenProcess
Sleep
CopyFileW
CreateEventA
CreateFileW
lstrlenW
GetModuleHandleA
lstrcatW
GetCurrentThreadId
DuplicateHandle
DeleteFileW
GetTempPathA
SuspendThread
ResumeThread
lstrcpyW
CreateThread
SwitchToThread
lstrcmpA
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
LeaveCriticalSection
SetLastError
lstrcmpiA
EnterCriticalSection
OpenWaitableTimerA
OpenMutexA
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
GetVersionExA
CreateWaitableTimerA
FileTimeToLocalFileTime
UnregisterWait
TlsGetValue
LoadLibraryExW
TlsSetValue
VirtualAlloc
RegisterWaitForSingleObject
VirtualProtect
TlsAlloc
ExitProcess
GetProcAddress
GetFileSize
GetDriveTypeW
GetLogicalDriveStringsW
WideCharToMultiByte
GetExitCodeProcess
CreateProcessA
CreateFileMappingA
OpenFileMappingA
LocalFree
lstrcpynA
GlobalLock
GlobalUnlock
Thread32First
Thread32Next
QueueUserAPC
OpenThread
GetModuleFileNameW
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetSystemTime
RemoveVectoredExceptionHandler
SleepEx
AddVectoredExceptionHandler
OpenEventA
LocalAlloc
FreeLibrary
RaiseException
FileTimeToSystemTime
VirtualFree
GetCurrentProcessId
GetVersion
ExpandEnvironmentStringsW
FindNextFileW
RemoveDirectoryW
FindClose
GetTempFileNameA
GetFileAttributesW
SetEndOfFile
SetFilePointer
FindFirstFileW
ResetEvent
GetComputerNameW
DeleteCriticalSection
VirtualProtectEx
lstrcmpiW
InitializeCriticalSection
CreateToolhelp32Snapshot
iphlpapi
GetAdaptersAddresses
GetIpAddrTable
GetBestRoute
oleaut32
VariantInit
VariantClear
SysAllocString
SysFreeString
Sections
.text Size: 310KB - Virtual size: 310KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ