Behavioral task
behavioral1
Sample
ursnif-worker.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ursnif-worker.dll
Resource
win10v2004-20230915-en
General
-
Target
ursnif-worker.bin
-
Size
178KB
-
MD5
29e6375ec2569aef3abc372f7a952b6f
-
SHA1
306411fe775887d8b247312a53e062564856fbe9
-
SHA256
7d028cd4c5fc29ddbf202584573034a92ebd6265261b306a063553d38862cce7
-
SHA512
61d6ed9fdd1c1bd01888912bee0968f16f4b9be5212525e73c0ad5f9964532694aa5d3cdb3b9ec6024de049e55a02374010978314766bb6b3e279b386b99c059
-
SSDEEP
3072:pB8R1zFVm5Af/ux4VOaC5Yph6e9L+l4zEAmBQ6ut0OudCUcF2f0s+cXP:uzKOfBVsYp8Pl4zEAqQ6ut0OuFcO+
Malware Config
Extracted
gozi
-
build
250260
-
exe_type
worker
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ursnif-worker.bin
Files
-
ursnif-worker.bin.dll windows:5 windows x86
aa4e7746d212e2ec3803b158ab36fe4e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
sprintf
strstr
ZwQueryInformationToken
ZwOpenProcess
ZwClose
ZwOpenProcessToken
strcpy
ZwQueryInformationProcess
RtlNtStatusToDosError
NtQuerySystemInformation
NtQueryInformationThread
_wcsupr
memmove
wcscpy
_snprintf
mbstowcs
ZwQueryKey
NtResumeProcess
RtlFreeUnicodeString
RtlUpcaseUnicodeString
NtSuspendProcess
wcstombs
RtlAdjustPrivilege
memset
_strupr
_snwprintf
memcpy
RtlImageNtHeader
NtSetInformationProcess
_aulldiv
_allmul
_chkstk
RtlUnwind
NtQueryVirtualMemory
kernel32
TlsAlloc
GetCurrentDirectoryW
LoadLibraryW
GetVersionExA
VirtualProtectEx
FileTimeToLocalFileTime
CreateFileMappingW
GetModuleFileNameA
GetModuleFileNameW
QueryPerformanceFrequency
GetLocalTime
FileTimeToSystemTime
GetComputerNameExA
GetComputerNameW
QueryPerformanceCounter
GetTempFileNameA
CreateThread
TerminateThread
GetCurrentProcessId
HeapAlloc
HeapFree
WaitForSingleObject
ExitThread
lstrlenW
GetLastError
ResetEvent
CloseHandle
DeleteFileW
CreateFileA
lstrlenA
WriteFile
lstrcatA
CreateDirectoryA
RemoveDirectoryA
LoadLibraryA
DeleteFileA
lstrcpyA
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
SetEvent
GetSystemTimeAsFileTime
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetFileSize
lstrcmpA
SetWaitableTimer
CreateDirectoryW
GetTickCount
GetCurrentThread
VirtualFree
GetWindowsDirectoryA
GetCommandLineA
InitializeCriticalSection
OpenProcess
Sleep
CopyFileW
CreateEventA
LeaveCriticalSection
TerminateProcess
CreateFileW
InterlockedExchange
VirtualAlloc
EnterCriticalSection
lstrcmpiW
lstrcatW
GetCurrentThreadId
DuplicateHandle
GetTempPathA
SuspendThread
ResumeThread
lstrcpyW
SwitchToThread
MapViewOfFile
UnmapViewOfFile
SetLastError
lstrcmpiA
OpenWaitableTimerA
OpenMutexA
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
CreateWaitableTimerA
UnregisterWait
TlsGetValue
LoadLibraryExW
TlsSetValue
RegisterWaitForSingleObject
VirtualProtect
GetVersion
GetProcAddress
OpenEventA
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetDriveTypeW
GetLogicalDriveStringsW
WideCharToMultiByte
GetExitCodeProcess
CreateProcessA
CreateFileMappingA
OpenFileMappingA
LocalFree
lstrcpynA
GlobalLock
GlobalUnlock
Thread32First
Thread32Next
QueueUserAPC
OpenThread
CreateToolhelp32Snapshot
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetSystemTime
SleepEx
LocalAlloc
FreeLibrary
RaiseException
DeleteCriticalSection
VirtualQuery
ExpandEnvironmentStringsW
RemoveDirectoryW
SetEndOfFile
SetFilePointer
FindNextFileW
FindClose
GetFileAttributesW
SetFilePointerEx
FindFirstFileW
SetCurrentDirectoryW
Sections
.text Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ