Extracted

• • Target
    fb4ef45c89a844cc3634dfa671063eaf3843e25d780f33b6268d3545096b8c54
  • Size 320KB
  • SHA256 fb4ef45c89a844cc3634dfa671063eaf3843e25d780f33b6268d3545096b8c54
  • MD5 7d35c8ae681e346c0857e415829f10b0
  • SHA1 e680f28578744bd237ca3ae96efefd0fbe67af00
  • SHA512 8b822c2c5a4ebc52eacf2e58eb657096c41cbb2e09bc1b06d0ded6b28f2519896446d975eeea702bef41611e6659759cb647519ad8f221ef079b5cabf9a55263
  • SSDEEP 6144:tRZq3EI7T9bMrBtl8Tln0OYZn855osyIoENdwT5k:Zq3H/9bMdtl8JA7T
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gozi_ifsb1080bankerpersistencetrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2