Behavioral task
behavioral1
Sample
b66d3f6e80add81b9f4e3b1ba5d8b4cc.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b66d3f6e80add81b9f4e3b1ba5d8b4cc.dll
Resource
win10v2004-20240226-en
General
-
Target
b66d3f6e80add81b9f4e3b1ba5d8b4cc
-
Size
240KB
-
MD5
b66d3f6e80add81b9f4e3b1ba5d8b4cc
-
SHA1
7b7b7fadb70ac17dc9e73b3d674e3e25083508c7
-
SHA256
2606c40933ea57d75211d34d1a197f40491b8ff9535daee06b2767b069848f4d
-
SHA512
6445c3bd538f998e14706a8eb78e70500aa45c2fcf1a8294fc18e7edf6e26f9ba0a0e664f8b64cab0e45be57d955d2f11d504b6cf3c883ff53abb9a33e439a8f
-
SSDEEP
6144:02yfji0Fu6oZMXe67BzvVLe+q+WXXO3WMbTcQ+:0vFu6gwN7BzvVe5/XIWMbP+
Malware Config
Extracted
gozi
2500
todo.faroin.at
apr.intoolkom.at
r23cirt55ysvtdvl.onion
kas.kargoapp.at
io.feen007.at
gtk.uploner.at
l46t3vgvmtx5wxe6.onion
pop.biopiof.at
free.monotreener.com
tb.yapker.at
app.flashgameo.at
-
exe_type
worker
-
server_id
580
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b66d3f6e80add81b9f4e3b1ba5d8b4cc
Files
-
b66d3f6e80add81b9f4e3b1ba5d8b4cc.dll windows:4 windows x64 arch:x64
561babba107cc2296485d4ba59217cf8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
strcpy
NtSetInformationProcess
sprintf
ZwClose
ZwQueryInformationToken
ZwOpenProcess
NtQuerySystemInformation
RtlNtStatusToDosError
ZwQueryInformationProcess
RtlImageNtHeader
_wcsupr
memmove
mbstowcs
wcscpy
_snprintf
RtlUpcaseUnicodeString
RtlFreeUnicodeString
ZwQueryKey
wcstombs
memcpy
memset
RtlAdjustPrivilege
_snwprintf
_strupr
NtQueryInformationThread
ZwOpenProcessToken
__C_specific_handler
__chkstk
OpenEventA
VirtualProtectEx
CreateFileMappingW
GetModuleFileNameA
GetModuleFileNameW
TerminateThread
CreateThread
GetCurrentProcessId
GetVersion
GetLocalTime
GetComputerNameW
QueryPerformanceFrequency
QueryPerformanceCounter
IsWow64Process
HeapAlloc
HeapFree
CreateDirectoryA
GetLastError
RemoveDirectoryA
CloseHandle
LoadLibraryA
CreateFileA
DeleteFileA
lstrcpyA
lstrlenA
WriteFile
lstrcatA
HeapDestroy
HeapCreate
SetEvent
HeapReAlloc
GetSystemTimeAsFileTime
GetModuleHandleA
ExitThread
SetWaitableTimer
OpenProcess
GetCurrentThreadId
GetFileSize
DuplicateHandle
GetTickCount
GetCurrentThread
lstrcmpA
Sleep
CopyFileW
CreateFileW
DeleteFileW
GetWindowsDirectoryA
EnterCriticalSection
GetTempPathA
CreateDirectoryW
ExitProcess
CreateEventA
GetCommandLineA
lstrcmpiW
SuspendThread
ResumeThread
WaitForSingleObject
lstrcpyW
LeaveCriticalSection
lstrlenW
lstrcatW
InitializeCriticalSection
SwitchToThread
SetLastError
lstrcmpiA
WaitForMultipleObjects
MapViewOfFile
ResetEvent
UnmapViewOfFile
OpenWaitableTimerA
CreateMutexA
OpenMutexA
ReleaseMutex
CreateWaitableTimerA
UnregisterWait
VirtualAlloc
VirtualProtect
TlsGetValue
RegisterWaitForSingleObject
TlsAlloc
LoadLibraryExW
TlsSetValue
TerminateProcess
GetTempFileNameA
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualFree
GetProcAddress
GetDriveTypeW
WideCharToMultiByte
GetLogicalDriveStringsW
OpenFileMappingA
GetExitCodeProcess
LocalFree
CreateProcessA
CreateFileMappingA
lstrcpynA
Thread32Next
Thread32First
CreateToolhelp32Snapshot
QueueUserAPC
OpenThread
DisconnectNamedPipe
FlushFileBuffers
CallNamedPipeA
CreateNamedPipeA
GetSystemTime
WaitNamedPipeA
ReadFile
ConnectNamedPipe
GetOverlappedResult
CancelIo
SleepEx
LocalAlloc
FreeLibrary
RaiseException
VirtualQuery
DeleteCriticalSection
ExpandEnvironmentStringsW
SetEndOfFile
SetFilePointer
RemoveDirectoryW
SetFilePointerEx
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
GetVersionExA
Sections
.text Size: 189KB - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ