Extracted

• • Target

    14c677290ebe1bf2be247eb076e2a702d1bc713d6ae249b1f00c78762c8b6549

  • Size

    507KB

  • MD5

    acae0628b7df86f2257e76c064adc63c

  • SHA1

    0ad10d85a70187745849d38551e6cb197f067d19

  • SHA256

    14c677290ebe1bf2be247eb076e2a702d1bc713d6ae249b1f00c78762c8b6549

  • SHA512

    a81035177ebded54a1b54061f84da06fe42ee56fb2f07e0a1c7cc39eb109b83c1ef196034bba743b1eca47e7a6b78866327f5f3c5fbfd93c084735c7d8332027

  Score

  10^/10

  gozi_ifsbbankerpersistencetrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2