Extracted

• • Target

    3354522abf0ba5c25fd93ef52cde13557584d6f2264daafc169c5f37ba08013c

  • Size

    477KB

  • MD5

    f6162f7578e8ffa56bb77ef2c285a075

  • SHA1

    eedc00b3acf3b31bd28623fa1e892328556661a2

  • SHA256

    3354522abf0ba5c25fd93ef52cde13557584d6f2264daafc169c5f37ba08013c

  • SHA512

    c05851bc72c044c53c4e4b6363faa5914b1466c4302a1d7e7881578c9e1f755cdb2db4e8e0ecb0153f660a0752286abda941dcba11e810f827c3a56110e8c0a3

  Score

  10^/10

  gozi_ifsbbankerpersistencetrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2