Extracted

• • Target

    wJireyEV.tmp.exe

  • Size

    322KB

  • MD5

    573b56ffd42efd390404133286ad691d

  • SHA1

    218f00d9ce955f2f196a93ae92a1588f6f1c1b36

  • SHA256

    19bcb38fae9b117b3e440f076fe7a7ebf169581dd89e3c5b8614f356ee2c4277

  • SHA512

    c054573268a4bcbf0a18a1d236250a66f07ba7e0f6b378e5ae3bfc2aa3e38211d99fd837b586af08dc052e10b64e1c1d984d5c4683dbff9014e7315aad352328

  Score

  10^/10

  trojanbackdoorsmokeloaderbankergozi_ifsbspywareursnif

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Ursnif, Dreambot

    Ursnif is a variant of the Gozi IFSB with more capabilities.

    bankertrojanursnif

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2