Extracted

• • Target
    63983f2b44a5dff65eb12d9ba76dfbaadcc320827410f3ac1530a2479b80c2ed
  • Size 708KB
  • SHA256 63983f2b44a5dff65eb12d9ba76dfbaadcc320827410f3ac1530a2479b80c2ed
  • MD5 a1c771407670d3659a93d6a8c18f4414
  • SHA1 e2108f99be0fd46ab971cde1cd059c04aa31044d
  • SHA512 174fb97c50caa011152fce2863356fe192fb82f7e6c4f1b1b2c3930378f44a314a6e04fb2359afe6668ec822972baefc4ef7b63fb13cbe1719af0e0c755e6e97
  • MD5 SHA1 SHA512

  Score

  10^/10

  gozi_ifsb1097bankerpersistencetrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2