Extracted

Extracted

• • Target

    b3b8433b8322d3884a24aa66d423bb386bd2d26edc86f09f5409a7a30b52bcfb

  • Size

    296KB

  • MD5

    0f4a3710b28ebbf430bc765f9b9e9740

  • SHA1

    362460f5f63c8cf844dc089454f72cb974046c07

  • SHA256

    b3b8433b8322d3884a24aa66d423bb386bd2d26edc86f09f5409a7a30b52bcfb

  • SHA512

    fdfa471259ecb69f64b749b485e9cb9d2be2227113117dc19facce9daba4f86f19dbe34fa36379e89ecc0ddaf42aaa69a275c15d78b50b6a80777001e4b4839c

  • SSDEEP

    6144:BSu1zvPvYDyLpj5weLCVrk0WRm/wpnN5Oie6xjMPt9eZiC3:gu1znL8k0WdNre6h+t9k

  Score

  10^/10

  gozi1099bankerisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Modifies Installed Components in the registry

    persistence

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2