Extracted

Extracted

• • Target

    500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781

  • Size

    243KB

  • MD5

    c2db310b19a07816183638816938eb5d

  • SHA1

    ea5d7cfd5d278f019a77b99cfac9a8e0709d591e

  • SHA256

    500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781

  • SHA512

    54cd7c8c5b100e222dd53f338f6f4b8d2fb1fc55db36e848288881b1b5e4ad8200b0cc45d2d36f54bff9faff55e4d49a54a17b866687d2905789a20375eaf772

  • SSDEEP

    6144:x4y6j8ncpnrKlEtSfTKfRn/kXfMbpuUW:uVAcpnulEEfWfR/YMbp

  Score

  10^/10

  gozi1000bankerisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2