Gozi_5867111c4ed7815ff1ec59f85b1f0352 Malware JSON Report

[*] MalFamily: ""

[*] MalScore: 10.0

[*] File Name: "Gozi_5867111c4ed7815ff1ec59f85b1f0352.exe"
[*] File Size: 562688
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "abee725d7461a5961b2654044441c95e974b46e7e25ceabe9b8857ddcde266be"
[*] MD5: "5867111c4ed7815ff1ec59f85b1f0352"
[*] SHA1: "32749f3d69725ff846c9154390d51126e4e0c93d"
[*] SHA512: "7b44a3d103724744ba186eef4f18f045c41018e14c688d0a0c5704507cc707959789870442402581c9b01242130e4a60e1b3f1987082774d4f5c5dc22c7b7d0e"
[*] CRC32: "45AA5F6A"
[*] SSDEEP: "6144:QkjP3Q+c/r94FN/cigBtt2S/ii50w8PNLIZUE:QkzFc6JgBttF/ii5BSNUZUE"

[*] Process Execution: [
    "Gozi_5867111c4ed7815ff1ec59f85b1f0352.exe",
    "svchost.exe",
    "WmiPrvSE.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "WmiPrvSE.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "WmiPrvSE.exe",
    "iexplore.exe",
    "iexplore.exe",
    "WMIADAP.exe"
]

[*] Signatures Detected: [
    {
        "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
        "Details": [
            {
                "IP": "204.79.197.200:80"
            },
            {
                "IP": "47.254.82.18:80"
            }
        ]
    },
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details": [
            {
                "process": "iexplore.exe, PID 1712"
            }
        ]
    },
    {
        "Description": "A process attempted to delay the analysis task.",
        "Details": [
            {
                "Process": "Gozi_5867111c4ed7815ff1ec59f85b1f0352.exe tried to sleep 1649 seconds, actually delayed analysis time by 0 seconds"
            },
            {
                "Process": "WmiPrvSE.exe tried to sleep 840 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details": [
            {
                "post_no_referer": "HTTP traffic contains a POST request with no referer header"
            },
            {
                "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
            },
            {
                "suspicious_request": "http://api.frame303.at/index.htm"
            },
            {
                "suspicious_request": "http://47.254.82.18/favicon.ico"
            },
            {
                "suspicious_request": "http://cde.frame303.at/index.htm"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://www.bing.com/favicon.ico"
            },
            {
                "url": "http://api.frame303.at/index.htm"
            },
            {
                "url": "http://47.254.82.18/favicon.ico"
            },
            {
                "url": "http://cde.frame303.at/index.htm"
            }
        ]
    },
    {
        "Description": "Crashed cuckoomon during analysis.  Report this error to the Github repo.",
        "Details": [
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x1967e in cuckoomon itself while accessing 0x16d5f8 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19681 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19681 in cuckoomon itself while accessing 0x16d5fc from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19684 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19684 in cuckoomon itself while accessing 0x16d5f4 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19687 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19687 in cuckoomon itself while accessing 0x16d5f0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19689 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19699 in cuckoomon itself while accessing 0x16d600 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x1969b in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x1969f in cuckoomon itself while accessing 0x16d604 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x196a2 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x196aa in cuckoomon itself while accessing 0x16d608 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x196ad in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x196bd in cuckoomon itself while accessing 0x16d60c from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x196c0 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19bfc in cuckoomon itself while accessing 0x16d5f0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19bfe in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19bfe in cuckoomon itself while accessing 0x16d5f4 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19c01 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19c01 in cuckoomon itself while accessing 0x16d5f8 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19c04 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19c04 in cuckoomon itself while accessing 0x16d5fc from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19c07 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x1967e in cuckoomon itself while accessing 0x16d678 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19681 in cuckoomon itself while accessing 0x16d67c from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19684 in cuckoomon itself while accessing 0x16d674 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19687 in cuckoomon itself while accessing 0x16d670 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19699 in cuckoomon itself while accessing 0x16d630 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x1969f in cuckoomon itself while accessing 0x16d634 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x196aa in cuckoomon itself while accessing 0x16d638 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x196bd in cuckoomon itself while accessing 0x16d63c from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19bfc in cuckoomon itself while accessing 0x16d670 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19bfe in cuckoomon itself while accessing 0x16d674 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19c01 in cuckoomon itself while accessing 0x16d678 from hook RtlDispatchException"
            },
            {
                "pid": 500
            },
            {
                "message": "Exception reported at offset 0x19c04 in cuckoomon itself while accessing 0x16d67c from hook RtlDispatchException"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13e2cb2.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13e3e46.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF14bddd3.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13e58c3.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13e7ae2.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13e9000.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13eaaeb.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13ebae8.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13ecd09.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13edd74.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13f0f42.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF14cb789.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13f3633.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13f6a82.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13f83a7.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13f97ac.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF13fb0f1.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF14d7b75.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF14d915f.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF1401b63.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF140581e.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF1407a3c.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF140c7a1.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF140f008.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF1413ce0.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF1416298.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF141af51.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF141fc96.TMP"
            }
        ]
    },
    {
        "Description": "Retrieves Windows ProductID, probably to fingerprint the sandbox",
        "Details": []
    },
    {
        "Description": "Checks the version of Bios, possibly for anti-virtualization",
        "Details": []
    },
    {
        "Description": "Attempts to modify proxy settings",
        "Details": []
    },
    {
        "Description": "Collects information to fingerprint the system",
        "Details": []
    }
]

[*] Started Service: []