Extracted

• • Target

    716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25

  • Size

    7.5MB

  • MD5

    4ec77eb8280485764b6bc22f6cf7d57e

  • SHA1

    85215638743eeb6800aaada5d057e96032db6906

  • SHA256

    716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25

  • SHA512

    770b14b133ac0a7bfee3a973d43a5342cd021a731f1be4d557a332aa4945dbb9be6b25909291feeb766c3fd640ff943780d4172e2fe6f6c77a128585e7914954

  Score

  10^/10

  babadedagozi_ifsb2002bankercrypterloadertrojan

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda

  • Babadeda Crypter

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2