Extracted

Extracted

• • Target
    SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.6966
  • Size 2.5MB
  • SHA256 edb86e9c3d29b3d13c82562dc1aeb1cd7e2c33e2bfcbae30791bf1d1aaf4345f
  • MD5 b545e2b0fdf47667624c08999c0b873e
  • SHA1 da6f23f5a9fbd123025d6a2b9cd39c2355b7345c
  • SHA512 908dc1ec45f023e649b9de0cc7cf32f2a02a404012cf78c393dce2b8064350a3ab1b8e541a920a6fdb94a17d05547ad77a1eda6a4e1c204472cf71749e71bda2
  • MD5 SHA1 SHA512

  Score

  10^/10

  gozi_ifsb20000bankersuricatatrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Beacon 3

    suricata: ET MALWARE Ursnif Variant CnC Beacon 3

    suricata

  • suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2