Gozi, also called Ursnif or Dreambot, is a banking trojan that dates back to 2007 and became very active again from 2020. Its main jobs are recording keystrokes and downloading other malware. It is commonly attributed to the actor tracked as Gold Cabin (TA551), a financially motivated group whose follow-on payloads often include Gozi and IcedID. Targets include finance, government and technology.
Delivery
spear-phishing email
-> PDF attachment
-> link inside the PDF
-> Gozi DLL (or a zip holding a JavaScript stage that fetches the DLL)
By the time I tested, the URL in the PDF had gone offline, so the DLL had to be analysed directly.
The DLL
A 32-bit Delphi DLL with many randomly named exports plus a DllRegisterServer export. All of these exports lead into each other. Each contains a small decryption loop and writes a few bytes at a time, so the final PE image only exists in memory after the whole chain has run.
export A decrypts chunk -> jumps to export B
export B decrypts chunk -> jumps to export C
...
last VirtualAlloc, copy the rebuilt PE into the new region
A breakpoint on VirtualAlloc fires only after all those loops have finished. The copy that follows is where the unpacked file appears, though a call to WaitForSingleObject throws an exception that stops the dump short and is also used as an evasion trick against automated analysis.
Dynamic behaviour
The sample queries registry keys related to domain controllers and Internet Explorer feature controls, and tries to relax security checks. Other registry keys are consistent with keylogging.
Indicators
pdf c334bcd8882669968904d0a2c37e72fc11ec35389b13a429a513594c4b9a52b2
dll 0b3d641004b2a730cd86a3131f6ae569e6692c03368dd1ac17f14bfd395e5bcb
payload 2faf1e82d3f932e6336108c64810d4a9b4a4ea6794028fc8c02d937f9fe548cf
c2 avas1ta[.]com njamma[.]com twinean[.]com
A second chain
A different campaign used a zip containing an HTA, which in turn ran a base64 PowerShell command to download the DLL. The DLL's entry point jumps through several memory-transfer layers, each decrypted by its own loop, before the system information collection starts.