General
-
Target
CryptOne_Exec_4ea543e3a45ed569a9f4f4bfa7c396a0e49c360f8ed304045f7799c73d5d915a.bin
-
Size
36KB
-
MD5
5776b6a779a4d340d89eca998cbf6e3b
-
SHA1
2a48e775e64f251172c23df581e8abdf39c169f2
-
SHA256
a8336a11e8fff8e35da77427870f82dc2f00139fd34b63548af65a79ac3d7b74
-
SHA512
20273241288daa1ff59f0f38d4f83ec888da71c3859874aabe02abce90ad61695fefcb66cf67215e1c69d8899045168830772ba75f53e41a66f002858279ce98
-
SSDEEP
768:hKbMPv5JLdybeM4CPSlWoEKCCldH24pjwg3jllNeErDqR:h4MHLLdNwPumCXnpjwgLkEK
Malware Config
Extracted
gozi
Extracted
gozi
999
reggy505.ru
iujdhsndjfks.ru
gameindikdowd.ru
jhgfdlkjhaoiu.su
reggy506.ru
-
base_path
/uploaded/
-
build
250249
-
exe_type
loader
-
extension
.pct
-
server_id
50
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CryptOne_Exec_4ea543e3a45ed569a9f4f4bfa7c396a0e49c360f8ed304045f7799c73d5d915a.bin
Files
-
CryptOne_Exec_4ea543e3a45ed569a9f4f4bfa7c396a0e49c360f8ed304045f7799c73d5d915a.bin.exe windows x86
1640d668d1471f340cbe565fe63522f6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
_snwprintf
memset
NtQuerySystemInformation
_aulldiv
kernel32
GetModuleHandleA
GetLocaleInfoA
GetSystemDefaultUILanguage
HeapAlloc
HeapFree
WaitForSingleObject
Sleep
ExitThread
lstrlenW
GetLastError
VerLanguageNameA
GetExitCodeThread
CloseHandle
HeapCreate
HeapDestroy
GetCommandLineW
ExitProcess
SetLastError
TerminateThread
SleepEx
GetModuleFileNameW
CreateThread
OpenProcess
CreateEventA
GetLongPathNameW
GetVersion
GetCurrentProcessId
GetProcAddress
LoadLibraryA
VirtualProtect
MapViewOfFile
GetSystemTimeAsFileTime
CreateFileMappingW
QueueUserAPC
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 1024B - Virtual size: 732B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ