Gozi_9bd1d88da5ad432179b072f03907c87b_bin_2019-07-15_11_30.txt

* MalFamily: "Gozi"

* MalScore: 10.0

* File Name: "Gozi_9bd1d88da5ad432179b072f03907c87b.bin"
* File Size: 639488
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "7c75fa89667a5e9b36d0964eeef1a5b53f06ab828289dda7c451507eb5ee707b"
* MD5: "9bd1d88da5ad432179b072f03907c87b"
* SHA1: "1f7b1d7e901a3b376ae3db13fa8d28e16b996a61"
* SHA512: "8f79dc5b4cefea46335af31f7c674f3296d9514e9488220de1d31472a5acce29a157f23da0b3723746d2ee7dd0e7752536ff3a6c9ed05de6b61eb7584bc55fbb"
* CRC32: "F3C7230B"
* SSDEEP: "12288:t6yNZssnrqn0CxdKVIOgwKgx1iaP6uDhR7XWsTgVD5EQNov7jWirv5Z/A:oyN6snrqn0CxgVIOgIBD6zVN/Norv5Z4"

* Process Execution:
    "Gozi_9bd1d88da5ad432179b072f03907c87b.bin",
    "control.exe",
    "rundll32.exe",
    "explorer.exe"


* Executed Commands:
    "C:\\Windows\\system32\\control.exe /?",
    "\"C:\\Windows\\system32\\rundll32.exe\" Shell32.dll,Control_RunDLL /?",
    "%SystemRoot%\\system32\\rundll32.exe Shell32.dll,Control_RunDLL /?"


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details":

                "process": "control.exe, PID 2824"




        "Description": "Deletes its original binary from disk",
        "Details":


        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details":

                "Injection": "Gozi_9bd1d88da5ad432179b072f03907c87b.bin(2924) -> control.exe(2824)"




        "Description": "Sniffs keystrokes",
        "Details":

                "SetWindowsHookExA": "Process: explorer.exe(2004)"




        "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
        "Details":

                "regkeyval": "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18\\Client32"


                "regkeyval": "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18\\Client64"




        "Description": "Installs itself for autorun at Windows startup",
        "Details":

                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\aecaM1M0"


                "data": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\ApiMM1M0\\aeevpisp.exe"




        "Description": "File has been identified by 44 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Trojan.GenericKD.32132510"


                "FireEye": "Generic.mg.9bd1d88da5ad4321"


                "McAfee": "GCrab-FNZ!9BD1D88DA5AD"


                "Cylance": "Unsafe"


                "Alibaba": "TrojanBanker:Win32/Gozi.365aa294"


                "K7GW": "Trojan ( 00551f251 )"


                "K7AntiVirus": "Trojan ( 00551f251 )"


                "Arcabit": "Trojan.Generic.D1EA4D9E"


                "TrendMicro": "Trojan.Win32.BLACKMAIL.USXVPGA19"


                "Symantec": "Trojan Horse"


                "APEX": "Malicious"


                "Avast": "Win32:Malware-gen"


                "Kaspersky": "Trojan-Banker.Win32.Gozi.dnu"


                "BitDefender": "Trojan.GenericKD.32132510"


                "Paloalto": "generic.ml"


                "AegisLab": "Trojan.Win32.Malicious.4!c"


                "Tencent": "Win32.Trojan-banker.Gozi.Hxpx"


                "Endgame": "malicious (high confidence)"


                "Emsisoft": "Trojan.GenericKD.32132510 (B)"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "GCrab-FNZ!9BD1D88DA5AD"


                "Sophos": "Mal/Generic-S"


                "Ikarus": "Trojan.Win32.Crypt"


                "Cyren": "W32/Trojan.IKIR-2774"


                "Avira": "TR/Crypt.Agent.arxly"


                "Antiy-AVL": "TrojanBanker/Win32.Gozi"


                "Microsoft": "Trojan:Win32/Skeeyah.A!MTB"


                "ZoneAlarm": "Trojan-Banker.Win32.Gozi.dnu"


                "GData": "Trojan.GenericKD.32132510"


                "AhnLab-V3": "Trojan/Win32.Agent.C3330812"


                "Acronis": "suspicious"


                "VBA32": "BScope.Trojan.Chapak"


                "ALYac": "Trojan.GenericKD.32132510"


                "Ad-Aware": "Trojan.GenericKD.32132510"


                "Malwarebytes": "Trojan.MalPack.GS"


                "ESET-NOD32": "a variant of Win32/Kryptik.GUMA"


                "TrendMicro-HouseCall": "Trojan.Win32.BLACKMAIL.USXVPGA19"


                "Rising": "[email protected] (RDMK:+gDh8bhEcYpAlu3YXO5OGg)"


                "Fortinet": "W32/Kryptik.GUMO!tr"


                "AVG": "Win32:Malware-gen"


                "Cybereason": "malicious.e901a3"


                "Panda": "Trj/GdSda.A"


                "CrowdStrike": "win/malicious_confidence_90% (W)"


                "Qihoo-360": "Win32/Trojan.3c9"




        "Description": "Creates a copy of itself",
        "Details":

                "copy": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\ApiMM1M0\\aeevpisp.exe"





* Started Service:

* Mutexes:
    "76AB94A1-5DAC-18C2-970A-E1CCBBDEA5C0",
    "Local\\CA7E941A-A1DF-8C74-7B9E-6580DFB269B4",
    "Local\\143F7FD9-631F-66FD-8D88-47FA113C6BCE",
    "Local\\C24B3540-3918-44E4-D316-7DB8B7AA016C",
    "D2C93950-09DF-D4DC-2326-4D4807BAD1FC",
    "7E83C072-C5D4-603F-3F92-C994E3E60D08"


* Modified Files:
    "\\??\\mailslot\\slb6c",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\ApiMM1M0\\aeevpisp.exe",
    "\\??\\pipe\\A6CCF2CA-CD7B-C8EA-873A-517CAB0E1570"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\Gozi_9bd1d88da5ad432179b072f03907c87b.bin"


* Modified Registry Keys:
    "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18",
    "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18\\Client32",
    "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18\\Client64",
    "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18\\Client",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\aecaM1M0",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableSPDY3_0",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA"


* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "interruption.ru",
        "answers":

                "data": "",
                "type": "NXDOMAIN"





* Domains:

        "ip": "",
        "domain": "interruption.ru"



* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: