gozi | 4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794N

General

Target
4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794N
Size 193KB
Sample241110-pvsppaxclg
SHA256 4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794
MD5 991f43cff60cc7c7f0fd272540b1bce0
SHA1 852b9190d6e7049857fa1e217a7b08878c4eaef3
SHA512 92a576300023da8d2ddbed3b2434e97ec0cc70d4ee463d765f16516ffdb26178d5cde3c3628b9c344cb2b2a92ca1ee68ad9a6133f5b9eda8756761d591022933
SSDEEP 6144:CO9uHzMxo0REaK4uodHqSRqlalq+dnBLzjw:FuHIxoHas4qsqglq+dW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

isfb gozi

Malware Config

Extracted

Family

gozi

Signatures

Gozi family
gozi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794N

File Explorer

4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794N

.dll 193KB

4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794N

IMPHASH 730c9891010f983512da088ad738a3be
SHA256 4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794
MD5 991f43cff60cc7c7f0fd272540b1bce0
SHA1 852b9190d6e7049857fa1e217a7b08878c4eaef3
SHA512 92a576300023da8d2ddbed3b2434e97ec0cc70d4ee463d765f16516ffdb26178d5cde3c3628b9c344cb2b2a92ca1ee68ad9a6133f5b9eda8756761d591022933
SSDEEP 6144:CO9uHzMxo0REaK4uodHqSRqlalq+dnBLzjw:FuHIxoHas4qsqglq+dW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

sprintf ZwQueryInformationToken ZwOpenProcess ZwClose ZwOpenProcessToken strcpy ZwQueryInformationProcess RtlNtStatusToDosError NtQuerySystemInformation wcscmp wcsncmp wcslen strstr strlen NtMapViewOfSection memcpy _snprintf _wcsupr _strupr memmove wcscpy memset ZwQueryKey RtlFreeUnicodeString RtlUpcaseUnicodeString wcstombs RtlImageNtHeader RtlAdjustPrivilege mbstowcs NtUnmapViewOfSection NtCreateSection wcscat _aulldiv _allmul _alldiv _chkstk RtlUnwind NtQueryVirtualMemory

kernel32

QueueUserAPC SetFilePointerEx QueueUserWorkItem FileTimeToLocalFileTime VirtualProtectEx GetComputerNameW SystemTimeToFileTime GetFileTime FindNextFileA FindFirstFileA CompareFileTime ExpandEnvironmentStringsA QueryPerformanceFrequency GetModuleFileNameA GetLocalTime GetModuleFileNameW CreateFileA lstrlenA HeapAlloc HeapFree WriteFile lstrcatA CreateDirectoryA GetLastError RemoveDirectoryA LoadLibraryA CloseHandle DeleteFileA lstrcpyA HeapReAlloc InterlockedIncrement InterlockedDecrement SetEvent GetTickCount HeapDestroy HeapCreate SetWaitableTimer CreateDirectoryW WaitForSingleObject GetCurrentThread GetSystemTimeAsFileTime GetWindowsDirectoryA OpenProcess Sleep CopyFileW CreateEventA CreateFileW lstrlenW InterlockedExchange lstrcmpiW GetModuleHandleA lstrcatW GetCurrentThreadId DuplicateHandle DeleteFileW GetTempPathA SuspendThread ResumeThread lstrcpyW CreateThread SwitchToThread lstrcmpA MapViewOfFile UnmapViewOfFile LeaveCriticalSection SetLastError lstrcmpiA EnterCriticalSection ResetEvent OpenWaitableTimerA OpenMutexA WaitForMultipleObjects CreateMutexA ReleaseMutex GetVersionExA CreateWaitableTimerA InitializeCriticalSection UnregisterWait TlsGetValue LoadLibraryExW TlsSetValue VirtualAlloc RegisterWaitForSingleObject VirtualProtect TlsAlloc GetProcAddress GetFileSize GetDriveTypeW GetLogicalDriveStringsW WideCharToMultiByte GetExitCodeProcess CreateProcessA CreateFileMappingA OpenFileMappingA LocalFree lstrcpynA GlobalLock GlobalUnlock Thread32First Thread32Next FileTimeToSystemTime OpenThread CreateToolhelp32Snapshot CallNamedPipeA WaitNamedPipeA ConnectNamedPipe ReadFile GetOverlappedResult DisconnectNamedPipe FlushFileBuffers CreateNamedPipeA CancelIo GetSystemTime RemoveVectoredExceptionHandler SleepEx AddVectoredExceptionHandler OpenEventA LocalAlloc FreeLibrary RaiseException VirtualFree QueryPerformanceCounter GetCurrentProcessId GetVersion DeleteCriticalSection RemoveDirectoryW FindClose GetTempFileNameA GetFileAttributesW SetEndOfFile SetFilePointer ExpandEnvironmentStringsW FindNextFileW LoadLibraryW SetEnvironmentVariableW FindFirstFileW GetEnvironmentVariableW GetCommandLineW ExitProcess

oleaut32

VariantInit VariantClear SysAllocString SysFreeString

Sharing