gozi | 77e7c5676e544d3ecb6d5fa9ebc634b8

Sharing

Copy URL

Twitter E-mail

General

Target

77e7c5676e544d3ecb6d5fa9ebc634b8
Size

242KB
MD5

77e7c5676e544d3ecb6d5fa9ebc634b8
SHA1

7fa45db5ff7113461288f7576d0b69c0cc932a4e
SHA256

d01013d9dbc6f31b2ae3168b323780f8f9f88029c009e05a7b561f42440cf161
SHA512

bbeea4619f005eece5f76e78bcc63ec8b6b4558a9f694916533ebb7f42a9a9ffb937c084c7757f50b26293b5b38e153c811cbdfa3b629425b0c5a4478c1beaca
SSDEEP

6144:QrezMySF6ymJNNDgq2L4LlcwFhR2hMX/BWEWk4SiFr:Qrc4FxmJrr2LicwlcMX/BWEWCit

Score

10^/10

isfb 1500 gozi

Malware Config

Extracted

Family

gozi

Botnet

1500

app.flashgameo.at

apr.intoolkom.at

r23cirt55ysvtdvl.onion

gtk5.variyan.at

pop.biopiof.at

l46t3vgvmtx5wxe6.onion

v10.avyanok.com

free.monotreener.com

sam.notlaren.at

Attributes

exe_type
worker
server_id
580

rsa_pubkey.plain

aes.plain

Signatures

Gozi family
gozi
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

77e7c5676e544d3ecb6d5fa9ebc634b8

resource
77e7c5676e544d3ecb6d5fa9ebc634b8

Files

77e7c5676e544d3ecb6d5fa9ebc634b8
.dll windows:4 windows x64 arch:x64

8a5d8f502e35131a4443369f6ddb5a6c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ZwQueryInformationToken
ZwClose
NtSetInformationProcess
sprintf
ZwOpenProcess
ZwOpenProcessToken
strcpy
ZwQueryInformationProcess
NtQuerySystemInformation
RtlNtStatusToDosError
RtlImageNtHeader
_wcsupr
memmove
mbstowcs
wcscpy
_snprintf
ZwQueryKey
RtlUpcaseUnicodeString
RtlFreeUnicodeString
_snwprintf
_strupr
wcstombs
memcpy
memset
RtlAdjustPrivilege
NtQueryInformationThread
__C_specific_handler
__chkstk
OpenEventA
VirtualProtectEx
CreateFileMappingW
GetModuleFileNameA
GetModuleFileNameW
TerminateThread
CreateThread
GetCurrentProcessId
IsWow64Process
GetVersion
GetLocalTime
GetComputerNameW
QueryPerformanceFrequency
QueryPerformanceCounter
HeapAlloc
HeapFree
CreateDirectoryA
GetLastError
RemoveDirectoryA
CloseHandle
LoadLibraryA
CreateFileA
DeleteFileA
lstrcpyA
lstrlenA
WriteFile
lstrcatA
HeapDestroy
HeapCreate
SetEvent
HeapReAlloc
GetSystemTimeAsFileTime
GetModuleHandleA
ExitThread
TerminateProcess
GetTickCount
GetCurrentThread
lstrcmpA
Sleep
CopyFileW
CreateFileW
GetWindowsDirectoryA
DeleteFileW
EnterCriticalSection
ExitProcess
CreateDirectoryW
GetTempPathA
CreateEventA
GetCommandLineA
lstrcmpiW
WaitForSingleObject
SuspendThread
ResumeThread
LeaveCriticalSection
lstrcpyW
InitializeCriticalSection
lstrlenW
lstrcatW
SwitchToThread
SetWaitableTimer
OpenProcess
GetFileSize
GetCurrentThreadId
DuplicateHandle
MapViewOfFile
ResetEvent
UnmapViewOfFile
OpenWaitableTimerA
CreateMutexA
OpenMutexA
ReleaseMutex
CreateWaitableTimerA
SetLastError
lstrcmpiA
WaitForMultipleObjects
TlsGetValue
RegisterWaitForSingleObject
TlsAlloc
LoadLibraryExW
TlsSetValue
UnregisterWait
VirtualAlloc
VirtualProtect
GetTempFileNameA
RemoveVectoredExceptionHandler
VirtualFree
AddVectoredExceptionHandler
GetProcAddress
GetDriveTypeW
WideCharToMultiByte
GetLogicalDriveStringsW
OpenFileMappingA
GetExitCodeProcess
LocalFree
CreateProcessA
CreateFileMappingA
lstrcpynA
Thread32Next
Thread32First
CreateToolhelp32Snapshot
QueueUserAPC
OpenThread
WaitNamedPipeA
ReadFile
ConnectNamedPipe
GetOverlappedResult
CancelIo
DisconnectNamedPipe
FlushFileBuffers
CallNamedPipeA
CreateNamedPipeA
GetSystemTime
SleepEx
LocalAlloc
FreeLibrary
RaiseException
VirtualQuery
DeleteCriticalSection
SetFilePointer
RemoveDirectoryW
ExpandEnvironmentStringsW
SetEndOfFile
FindClose
GetFileAttributesW
SetFilePointerEx
FindFirstFileW
FindNextFileW
GetVersionExA

Sections

.text
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

8a5d8f502e35131a4443369f6ddb5a6c

Headers

File Characteristics

Imports

Sections

.text Size: 191KB - Virtual size: 190KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 6KB - Virtual size: 7KB

.pdata Size: 6KB - Virtual size: 6KB

.bss Size: 8KB - Virtual size: 7KB

.reloc Size: 3KB - Virtual size: 4KB

.text
Size: 191KB - Virtual size: 190KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 6KB - Virtual size: 7KB

.pdata
Size: 6KB - Virtual size: 6KB

.bss
Size: 8KB - Virtual size: 7KB

.reloc
Size: 3KB - Virtual size: 4KB