Extracted

• • Target

    57b374e2d2f002c11c69b454fcf1aa57bd971cd0638eca12c6691cdb6a2f011c

  • Size

    457KB

  • MD5

    13b78d808996120ae0ce4d1b19947c3e

  • SHA1

    6937e2e6301f5ecb0251c26a3ad0afe4a0d30aed

  • SHA256

    57b374e2d2f002c11c69b454fcf1aa57bd971cd0638eca12c6691cdb6a2f011c

  • SHA512

    1c8000f502c10222aa4e14ae00a709d0f0684286de3a125b41649d8749632a91fba31866ce949713cc7920651745ab1f1f9fe3568d25c9065e37de2c47f754dd

  Score

  10^/10

  gozi_ifsbbankerpersistencetrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2