gozi | cf6f7b82615eaf92d63a1a4bc5026517ecf1462d4099f07839ad8b2f5c50f83c[.]bin

General

Target
cf6f7b82615eaf92d63a1a4bc5026517ecf1462d4099f07839ad8b2f5c50f83c.bin
Size 61KB
Sample260820-vt6g2ssapd
SHA256 cf6f7b82615eaf92d63a1a4bc5026517ecf1462d4099f07839ad8b2f5c50f83c
MD5 1647a54c585d07872ad00c1acb51a796
SHA1 ecb993a4499836c1131219f98b7e781c8d0a70fa
SHA512 31325a72bc0042a9529b7c2d13562cf26a1c4019e39d7a68a129e9b70181fc65ef0397199507e4704c8b54eb80821f7abe1b121070ff2856d79f29727761c103
SSDEEP 768:PGIUH2qRilkZmNWz8KYfck8d6G0Hb0qDwvSDP0PAPHOzD/sbS6fjrLvqrHEvEzw/:PtYubJIqsqcoG/smevqrHEvEzR29wfA
TLSH
T138536D27E6F50159C46ACAB1D5B10B97DBB0F4085B28B71F0391CEAC3F532A1A71D7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

isfb banker trojan gozi

Malware Config

Extracted

Family

gozi

Signatures

Family: Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf6f7b82615eaf92d63a1a4bc5026517ecf1462d4099f07839ad8b2f5c50f83c.bin

File Explorer

cf6f7b82615eaf92d63a1a4bc5026517ecf1462d4099f07839ad8b2f5c50f83c.bin

.dll 61KB

cf6f7b82615eaf92d63a1a4bc5026517ecf1462d4099f07839ad8b2f5c50f83c.bin

IMPHASH b960505c7f0edaf9d6d19dfdaf34d099
SHA256 cf6f7b82615eaf92d63a1a4bc5026517ecf1462d4099f07839ad8b2f5c50f83c
MD5 1647a54c585d07872ad00c1acb51a796
SHA1 ecb993a4499836c1131219f98b7e781c8d0a70fa
SHA512 31325a72bc0042a9529b7c2d13562cf26a1c4019e39d7a68a129e9b70181fc65ef0397199507e4704c8b54eb80821f7abe1b121070ff2856d79f29727761c103
SSDEEP 768:PGIUH2qRilkZmNWz8KYfck8d6G0Hb0qDwvSDP0PAPHOzD/sbS6fjrLvqrHEvEzw/:PtYubJIqsqcoG/smevqrHEvEzR29wfA
TLSH
T138536D27E6F50159C46ACAB1D5B10B97DBB0F4085B28B71F0391CEAC3F532A1A71D7A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

HeapAlloc HeapFree HeapDestroy HeapCreate SetEvent GetTickCount MapViewOfFile UnmapViewOfFile VirtualQuery OpenProcess WaitForMultipleObjects SetWaitableTimer GetLastError lstrcatW CloseHandle CreateWaitableTimerA SleepEx OpenFileMappingA LocalAlloc GetProcAddress FreeLibrary LoadLibraryA RaiseException ResetEvent GetComputerNameW ExpandEnvironmentStringsA GetTempPathA GetTempFileNameA CreateDirectoryA GetFileSize ExpandEnvironmentStringsW lstrcpyW FindClose CreateDirectoryW GetFileTime GetCurrentThreadId GetCurrentProcessId ResumeThread CreateThread VirtualAlloc EnterCriticalSection InitializeCriticalSection TerminateThread Sleep GetVersionExW LeaveCriticalSection GetModuleHandleA GetVersion CreateEventA lstrcpynA lstrlenA lstrcpyA lstrcatA WaitForSingleObject QueryPerformanceFrequency ReadFile CreateFileW lstrlenW QueryPerformanceCounter CreateFileA WriteFile SetEndOfFile FindNextFileA lstrcmpiW FlushFileBuffers FindFirstFileA CompareFileTime

ntdll

_snprintf sprintf ZwOpenProcessToken ZwClose ZwQueryInformationToken ZwOpenProcess strcpy mbstowcs ZwQueryInformationProcess memcpy memset __C_specific_handler __chkstk

Sharing