Extracted

• • Target
    5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80
  • Size 361KB
  • SHA256 5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80
  • MD5 64139ece03d78520b9dae8d1313da69e
  • SHA1 45e19e267688c8472ce882afe93becb043b718d1
  • SHA512 2daa3467bb5bb3af17f94503946eab4f07e8a7e09906ed54d843aa80ae90ced32d574b08b7c1ee78c56d3a7a950799cafa9705d1c39df3e9888865a004db7b84
  • MD5 SHA1 SHA512

  Score

  10^/10

  gozi_ifsb1010bankerpersistencetrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2