gozi | 687e75e8717807ae96fb941054c8904e4fb695d4acd1073159e0d8c078e6674d[.]bin

General

Target
687e75e8717807ae96fb941054c8904e4fb695d4acd1073159e0d8c078e6674d.bin
Size 61KB
Sample260820-vt4nfssapb
SHA256 687e75e8717807ae96fb941054c8904e4fb695d4acd1073159e0d8c078e6674d
MD5 f32f9d6379569d555c0aef5133498718
SHA1 ab29ba144ec492377eb457a4e0ed905064779a81
SHA512 030c3401264b3d2c3aff29d76a672bac684d4b16c51989084a001484e260f3d36ba46a5a194ec2ddecbb371743f93df67df6eeb69e6a8dd4dc4ca9ee3257a8f6
SSDEEP 768:SGIUH2qRilkZmNWz8KYfck8d6G0Hb0qDwvSDP0PAPHOzD/sbS6fjrLvqrHEvEzw/:StYubJIqsqcoG/smevqrHEvEzR29wfA
TLSH
T1B8536D27E6F50159C46ACAB1D5B10B97DBB0F4085B28B71F0391CEAC3F532A1A71D7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

isfb banker trojan gozi

Malware Config

Extracted

Family

gozi

Signatures

Family: Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
687e75e8717807ae96fb941054c8904e4fb695d4acd1073159e0d8c078e6674d.bin

File Explorer

687e75e8717807ae96fb941054c8904e4fb695d4acd1073159e0d8c078e6674d.bin

.dll 61KB

687e75e8717807ae96fb941054c8904e4fb695d4acd1073159e0d8c078e6674d.bin

IMPHASH b960505c7f0edaf9d6d19dfdaf34d099
SHA256 687e75e8717807ae96fb941054c8904e4fb695d4acd1073159e0d8c078e6674d
MD5 f32f9d6379569d555c0aef5133498718
SHA1 ab29ba144ec492377eb457a4e0ed905064779a81
SHA512 030c3401264b3d2c3aff29d76a672bac684d4b16c51989084a001484e260f3d36ba46a5a194ec2ddecbb371743f93df67df6eeb69e6a8dd4dc4ca9ee3257a8f6
SSDEEP 768:SGIUH2qRilkZmNWz8KYfck8d6G0Hb0qDwvSDP0PAPHOzD/sbS6fjrLvqrHEvEzw/:StYubJIqsqcoG/smevqrHEvEzR29wfA
TLSH
T1B8536D27E6F50159C46ACAB1D5B10B97DBB0F4085B28B71F0391CEAC3F532A1A71D7A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

HeapAlloc HeapFree HeapDestroy HeapCreate SetEvent GetTickCount MapViewOfFile UnmapViewOfFile VirtualQuery OpenProcess WaitForMultipleObjects SetWaitableTimer GetLastError lstrcatW CloseHandle CreateWaitableTimerA SleepEx OpenFileMappingA LocalAlloc GetProcAddress FreeLibrary LoadLibraryA RaiseException ResetEvent GetComputerNameW ExpandEnvironmentStringsA GetTempPathA GetTempFileNameA CreateDirectoryA GetFileSize ExpandEnvironmentStringsW lstrcpyW FindClose CreateDirectoryW GetFileTime GetCurrentThreadId GetCurrentProcessId ResumeThread CreateThread VirtualAlloc EnterCriticalSection InitializeCriticalSection TerminateThread Sleep GetVersionExW LeaveCriticalSection GetModuleHandleA GetVersion CreateEventA lstrcpynA lstrlenA lstrcpyA lstrcatA WaitForSingleObject QueryPerformanceFrequency ReadFile CreateFileW lstrlenW QueryPerformanceCounter CreateFileA WriteFile SetEndOfFile FindNextFileA lstrcmpiW FlushFileBuffers FindFirstFileA CompareFileTime

ntdll

_snprintf sprintf ZwOpenProcessToken ZwClose ZwQueryInformationToken ZwOpenProcess strcpy mbstowcs ZwQueryInformationProcess memcpy memset __C_specific_handler __chkstk

Sharing