Extracted

Extracted

• • Target

    3b5da20c1a04ee07fe519a180c4343b9947b099fdfdc889f9f0e15d203ae1a6f

  • Size

    383KB

  • MD5

    1f06e94d0fe50094a632018c625ff35b

  • SHA1

    c1b0c111496158aa7630f5cebea2884f35ee8f57

  • SHA256

    3b5da20c1a04ee07fe519a180c4343b9947b099fdfdc889f9f0e15d203ae1a6f

  • SHA512

    4dd7624b0846061ff708d645a9ae95ccc133cf005a98f81050d6ffc8e578d8284a2c695b0f2718cea3b75dfb822dec7d2c84673aa68446950e319595b21e7407

  • SSDEEP

    6144:ljx0Ssk2mAw93YPdHBpMGFm9Zi0w8LgnXYPToCKpDCSw7dXC6ALDq:px3sFmxyTFJ09snUoCKpDmVCo

  Score

  10^/10

  gozi1004bankerisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2