gozi | d6dab315a078a0472ab18e5fed1aafefbb651eacde5d6db1445472a38c738fd0

Sharing

Copy URL Twitter E-mail

General

Target
d6dab315a078a0472ab18e5fed1aafefbb651eacde5d6db1445472a38c738fd0
Size 3.8MB
Sample240206-1gefpaggh4
SHA256 d6dab315a078a0472ab18e5fed1aafefbb651eacde5d6db1445472a38c738fd0
MD5 0e2ecea4254271002e99cfb044d4ee6e
SHA1 f961c84425d9e4f869f1dc9bb09bf379fd4b0b62
SHA512 c6f7f632623e21e4530571e35c2f5e693c1b9f217055074d8e5dfde7421475d67d523ff24bbbb25082cda389799da6d78cb67316aa6b3c4eac9b069ed498e005
SSDEEP 98304:jEjlmQbfgSgwvSnN4iVJui0xdRoM5XBHsdqR:jEjgQPXqOvWdqR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

isfb gozi

Malware Config

Extracted

Family

gozi

Signatures

Gozi family
gozi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6dab315a078a0472ab18e5fed1aafefbb651eacde5d6db1445472a38c738fd0

File Explorer

d6dab315a078a0472ab18e5fed1aafefbb651eacde5d6db1445472a38c738fd0

.exe 3.8MB

d6dab315a078a0472ab18e5fed1aafefbb651eacde5d6db1445472a38c738fd0

IMPHASH da615ad92cf6c6d9159a7eb2aceeb372
SHA256 d6dab315a078a0472ab18e5fed1aafefbb651eacde5d6db1445472a38c738fd0
MD5 0e2ecea4254271002e99cfb044d4ee6e
SHA1 f961c84425d9e4f869f1dc9bb09bf379fd4b0b62
SHA512 c6f7f632623e21e4530571e35c2f5e693c1b9f217055074d8e5dfde7421475d67d523ff24bbbb25082cda389799da6d78cb67316aa6b3c4eac9b069ed498e005
SSDEEP 98304:jEjlmQbfgSgwvSnN4iVJui0xdRoM5XBHsdqR:jEjgQPXqOvWdqR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2238911

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Devops\agent\workspace\p-111758179e0043a5b011650a32a71ea0\src\TGBDownloader\Output\TGBDownloader\Release\TGBDownloader.pdb

psapi

GetModuleFileNameExA

ws2_32

ntohl htons WSAStartup WSAGetLastError __WSAFDIsSet select shutdown connect recv send socket ioctlsocket setsockopt closesocket gethostbyname htonl WSACleanup

kernel32

CreateFileMappingW MapViewOfFile UnmapViewOfFile EnterCriticalSection LeaveCriticalSection DuplicateHandle SetErrorMode TerminateProcess RaiseException GetFileTime GetCurrentDirectoryW SetCurrentDirectoryW GetTempPathW CopyFileW GetFileAttributesW GetFileSizeEx GetTempPathA TerminateThread FreeResource GetUserDefaultUILanguage DecodePointer ProcessIdToSessionId OpenMutexW CreateMutexW GetLogicalDrives GetDriveTypeW DeviceIoControl FindFirstFileW RemoveDirectoryW MoveFileExW FindNextFileW FindClose GetExitCodeProcess IsDBCSLeadByte GetFullPathNameW SetEndOfFile SetFilePointerEx CreateFileA SwitchToThread CreateDirectoryA GetPrivateProfileIntA GetPrivateProfileStringA GetVersionExW LoadLibraryA GetSystemDefaultLangID OpenProcess SleepEx CreateMutexA AreFileApisANSI TryEnterCriticalSection HeapCreate GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA UnlockFileEx HeapValidate FormatMessageW GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile WaitForSingleObjectEx GetVersionExA DeleteFileA HeapCompact UnlockFile CreateFileMappingA LocalFree LockFileEx SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA QueryPerformanceCounter FlushFileBuffers GetStdHandle GetFileType GetModuleHandleA GlobalMemoryStatus FlushConsoleInputBuffer GetACP lstrlenW GlobalLock GlobalUnlock ExitProcess VerSetConditionMask CreateDirectoryW LocalFileTimeToFileTime GlobalAlloc lstrcpyW lstrcmpiW IsValidCodePage SetStdHandle GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW SetEnvironmentVariableA SetConsoleMode ReadConsoleInputA GetConsoleMode SetConsoleCtrlHandler GetModuleHandleExW ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue InitializeSListHead GetStartupInfoW UnhandledExceptionFilter ResetEvent IsDebuggerPresent LCMapStringW CompareStringW GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError QueryPerformanceFrequency FindFirstFileExW GetNativeSystemInfo GetExitCodeThread GetCurrentThread GetStringTypeW EncodePointer InitializeCriticalSection GetCurrentProcessId GetModuleFileNameA GetSystemDirectoryW GetEnvironmentVariableW GetLocaleInfoW GetPrivateProfileSectionW GetPrivateProfileIntW VerifyVersionInfoW SetUnhandledExceptionFilter GetPrivateProfileStringW GetCommandLineW GetSystemInfo GetDiskFreeSpaceExW GlobalMemoryStatusEx OutputDebugStringW IsProcessorFeaturePresent PeekNamedPipe CreateProcessA CreatePipe DeleteCriticalSection InitializeCriticalSectionAndSpinCount LoadLibraryW FreeLibrary InterlockedExchangeAdd GetTickCount GetFileAttributesExW GetLocalTime GetModuleFileNameW InterlockedDecrement InterlockedIncrement MoveFileW DeleteFileW SetFilePointer SetEvent WaitForSingleObject CreateEventW FindResourceExW FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte Sleep InterlockedExchange InterlockedCompareExchange GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetCurrentThreadId GlobalFree MultiByteToWideChar GetCurrentProcess GetFileSize WriteFile ReadFile GetLastError GetModuleHandleW GetProcAddress CreateFileW CloseHandle GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW MulDiv

user32

GetWindowTextW InvalidateRgn wsprintfW EnumDisplayDevicesW GetDC MonitorFromWindow GetMonitorInfoW ReleaseDC DestroyWindow DefWindowProcW GetSystemMetrics MessageBoxW GetWindowTextLengthW SetWindowTextW IsWindowEnabled DestroyMenu TrackPopupMenu InvalidateRect IsWindow GetProcessWindowStation GetUserObjectInformationW MessageBoxA IsRectEmpty IntersectRect PtInRect SetCursor LoadCursorW CreateAcceleratorTableW OffsetRect InflateRect UnionRect SendMessageW GetWindowRect ScreenToClient GetKeyState GetClientRect SetWindowPos GetWindowLongW SetWindowLongW IsIconic GetActiveWindow GetWindow SetFocus BeginPaint EndPaint GetUpdateRect IsWindowVisible MapWindowPoints CreateWindowExW GetCursorPos ReleaseCapture GetSysColor GetMessageW EnableMenuItem AppendMenuW CreatePopupMenu GetCaretBlinkTime TranslateMessage DispatchMessageW IsZoomed PostMessageW GetFocus SetTimer KillTimer SetCapture GetParent LoadImageW SetWindowRgn ShowWindow EnableWindow PostQuitMessage RegisterClassW GetClassInfoExW RegisterClassExW GetGUIThreadInfo SetForegroundWindow MapVirtualKeyExW GetKeyNameTextW CharNextW CallWindowProcW SetPropW ClientToScreen SetCaretPos GetCaretPos HideCaret ShowCaret GetPropW EqualRect FillRect CreateCaret GetWindowRgn UpdateLayeredWindow MoveWindow CharPrevW DrawTextW SetRect GetKeyboardLayout

gdi32

SelectClipRgn CreateRoundRectRgn PlayEnhMetaFile GetEnhMetaFileHeader CreateDIBitmap AddFontMemResourceEx GetTextMetricsW CloseEnhMetaFile CreateEnhMetaFileW SetWindowOrgEx Rectangle RestoreDC BitBlt SaveDC SelectObject CreateCompatibleDC CombineRgn RemoveFontMemResourceEx CreatePen GetClipBox GetStockObject GetObjectW GetObjectA DeleteObject CreateCompatibleBitmap GetDeviceCaps CreateDIBSection StretchBlt CreateRectRgn SetStretchBltMode CreateSolidBrush CreatePenIndirect MoveToEx LineTo RoundRect PtInRegion CreatePatternBrush CreateRectRgnIndirect CreateFontIndirectW ExtSelectClipRgn GetBitmapBits SetBitmapBits SetBkMode SetTextColor SetBkColor GetCharABCWidthsW GetTextExtentPoint32W TextOutW DeleteDC GdiFlush

advapi32

RegQueryValueExA RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey ReportEventA RegisterEventSourceA DeregisterEventSource CryptReleaseContext CryptGenRandom CryptAcquireContextW RegOpenKeyExA

shell32

SHCreateDirectoryExW ord165 ShellExecuteExW SHChangeNotify SHGetPathFromIDListW DragQueryFileW SHGetSpecialFolderPathW SHGetFolderPathA CommandLineToArgvW ShellExecuteExA SHBrowseForFolderW

ole32

ReleaseStgMedium CreateStreamOnHGlobal RegisterDragDrop DoDragDrop OleDuplicateData CoInitialize CoCreateInstance CoUninitialize CoInitializeEx CoTaskMemFree CoCreateGuid CLSIDFromString CLSIDFromProgID OleLockRunning

comctl32

ord17 _TrackMouseEvent

gdiplus

GdipDrawString GdipMeasureString GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDrawImageRectI GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipSetInterpolationMode GdipSetSmoothingMode GdipSetTextRenderingHint GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawRectangleI GdipTranslateWorldTransform GdipDeletePen GdipCreatePen1 GdipFillRectangleI GdipDeleteBrush GdipCreateSolidFill GdipDeleteGraphics GdipCreateFromHDC GdipDisposeImage GdipCloneImage GdipAlloc GdipFree GdipLoadImageFromStream GdiplusShutdown GdiplusStartup GdipSetPenMode GdipRotateWorldTransform GdipSetStringFormatTrimming

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

winhttp

WinHttpWriteData WinHttpSetOption WinHttpSendRequest WinHttpGetProxyForUrl WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpGetIEProxyConfigForCurrentUser WinHttpSetTimeouts WinHttpCloseHandle WinHttpOpen

shlwapi

PathFileExistsW PathRemoveFileSpecW PathAddBackslashW PathRemoveFileSpecA PathIsDirectoryW

d3d9

Direct3DCreate9

urlmon

URLDownloadToFileA

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

netapi32

Netbios

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

532KB

Virtual Size

531KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

64KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.QMGuid

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

608KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=24, id=241, version=40116,

count=199, id=243, version=40116,

count=32, id=242, version=40116,

count=3, id=199, version=41118,

count=26, id=259, version=24123,

count=2, id=261, version=23013,

count=126, id=261, version=24123,

count=39, id=260, version=24123,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=14, productName=Unmarked objects (old),

count=329, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=28, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=557, id=1, productName=Unmarked objects,

count=119, id=265, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,