Extracted

• • Target

    514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54

  • Size

    497KB

  • MD5

    607b8176885a9c8c8f2be0067ee9aeba

  • SHA1

    7bbe505272fac18a05491b0c6f6bc92a7c26dc23

  • SHA256

    514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54

  • SHA512

    372eda54a5ddba51de3f091df58d00d451bb83820d79b3f97209dfbfda6991a3e3f5647b8ba0291b80b1d6322cef844ced08c7a74e0cf280b86455f00fc626a8

  • SSDEEP

    12288:U80ftiYRgLLrxRzG6h2/8E9rK/PIEIkqv59SLes:10tjRgXG6h2D04EIkqv5UV

  Score

  10^/10

  gozi_ifsb1000bankerpersistencetrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2