Behavioral task
behavioral1
Sample
0da1e85be9a2965c12fda89ccc5a73e454935f7b5363b9c90922a1941498fbbd.exe
Resource
win7-20230831-en
General
-
Target
11716758656.zip
-
Size
32KB
-
MD5
d408bece00dc82feb435e6bc3332db1c
-
SHA1
0d2083b18e685146ef76bfbea55aad7d0ee475db
-
SHA256
a074ccc56db54a7850a9297747f3e0ab1fece4c29e88d6e141a6c555d4ce8e1e
-
SHA512
5df29105f5676650b662a5caf6c186ba8ee8d89b0492529f3ee772f5f8150d90414428110eb8c5600ed5c7a699f45473b302013778c553c1ac04df5e9cbc26bd
-
SSDEEP
768:xEXjQ6MoFKeeYuAM9wjz5uptfQR/yMtqitZzwIKvN45xot:KTVbt/uAMZI1witZct0at
Malware Config
Extracted
gozi
Extracted
gozi
40000
lentaphoto.at
iujdhsndjfks.ru
gameindikdowd.ru
jhgfdlkjhaoiu.su
-
base_path
/uploaded/
-
build
250249
-
exe_type
loader
-
extension
.pct
-
server_id
50
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/0da1e85be9a2965c12fda89ccc5a73e454935f7b5363b9c90922a1941498fbbd
Files
-
11716758656.zip.zip
Password: infected
-
0da1e85be9a2965c12fda89ccc5a73e454935f7b5363b9c90922a1941498fbbd.exe windows x86
Password: infected
1640d668d1471f340cbe565fe63522f6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
_snwprintf
memset
NtQuerySystemInformation
_aulldiv
kernel32
GetModuleHandleA
GetLocaleInfoA
GetSystemDefaultUILanguage
HeapAlloc
HeapFree
WaitForSingleObject
Sleep
ExitThread
lstrlenW
GetLastError
VerLanguageNameA
GetExitCodeThread
CloseHandle
HeapCreate
HeapDestroy
GetCommandLineW
ExitProcess
SetLastError
TerminateThread
SleepEx
GetModuleFileNameW
CreateThread
OpenProcess
CreateEventA
GetLongPathNameW
GetVersion
GetCurrentProcessId
GetProcAddress
LoadLibraryA
VirtualProtect
MapViewOfFile
GetSystemTimeAsFileTime
CreateFileMappingW
QueueUserAPC
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 1024B - Virtual size: 732B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ