Extracted

Extracted

• • Target
    67d52ee19a6ec25a03808f9ae1795d43.exe
  • Size 558KB
  • SHA256 8726eeaad39b500f79072e8da7510e2b136bbc40c5ce31ab33e505beec1fc644
  • MD5 67d52ee19a6ec25a03808f9ae1795d43
  • SHA1 15e8b996dbf37982ee5cfb069dafce40ddacc53c
  • SHA512 965bbcea29a4e32f1e59a966cd1435737dc5cb86e752fbfdf08931c23c6cdc39ec30387e44f893bec2ae30dae3600f2068ade49c3073154d7375b20ca49d84d1
  • MD5 SHA1 SHA512

  Score

  10^/10

  gozi_ifsbraccoon563129eb2a69de0d6dd4671019520d08f6eb48306565bankerdiscoveryspywarestealertrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2