gozi_ifsb | 315208c0c02409b64d45dbc1e09588e1fda3ff2a0919c118aa927e8168206881

Analysis

max time kernel
417s
max time network
421s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 00:02

Target

25bdab9cf1c2dbb6e96e1b0797a4facaa0c3469164f1653328e4357fb421e061_unpacked_x64.dll
Size

365KB
MD5

7f3bb08e029327bf72614a321d168fc5
SHA1

11318142a225eeb3df6800123318a89128cbd64f
SHA256

315208c0c02409b64d45dbc1e09588e1fda3ff2a0919c118aa927e8168206881
SHA512

06a541ee3e3504300d4448ac9d1ff9086f5bd887df278376d5c518ccf4ab295aa399e16bc984b306e11e55d63ede18860371cd38548512d1f8c2b682db05df4e
SSDEEP

6144:FpCXhArO/UtJ3CAa2oyd8JBglTn3C0nt6e2J62hv4QpoHo0BpqnBVKXClZ5L:FpXrOM/Ha2oyd8YTn3CpP6IgQpoHo0Bk

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25bdab9cf1c2dbb6e96e1b0797a4facaa0c3469164f1653328e4357fb421e061_unpacked_x64.dll,#1
1⤵
PID:1900