Extracted

• • Target

    fb4ef45c89a844cc3634dfa671063eaf3843e25d780f33b6268d3545096b8c54

  • Size

    320KB

  • MD5

    7d35c8ae681e346c0857e415829f10b0

  • SHA1

    e680f28578744bd237ca3ae96efefd0fbe67af00

  • SHA256

    fb4ef45c89a844cc3634dfa671063eaf3843e25d780f33b6268d3545096b8c54

  • SHA512

    8b822c2c5a4ebc52eacf2e58eb657096c41cbb2e09bc1b06d0ded6b28f2519896446d975eeea702bef41611e6659759cb647519ad8f221ef079b5cabf9a55263

  • SSDEEP

    6144:tRZq3EI7T9bMrBtl8Tln0OYZn855osyIoENdwT5k:Zq3H/9bMdtl8JA7T

  Score

  10^/10

  gozi_ifsb1080bankerpersistencetrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2