Extracted

Extracted

• • Target

    b09866ef7ae80f0cf8d4525be79bffe7f0141e4cb653c55503e537ba0d2075ca

  • Size

    249KB

  • MD5

    d1ab21b566481909ab75929a5fa6da67

  • SHA1

    3f5228385e2d056bc77102ed3aa13932cdfd411f

  • SHA256

    b09866ef7ae80f0cf8d4525be79bffe7f0141e4cb653c55503e537ba0d2075ca

  • SHA512

    619a69b1bfcde005a8e6fa44bf561761bb95b771564a19029860d8bcb49bbfa7d1e31ff68134dd091ff3a56906cf96a70fc512f85590f2dd0a434df313f6ca44

  • SSDEEP

    6144:1pmGKf0ra/G4uzAbqBcoBI+6MxiMNGbNOx:vmGKLGUSc2I+j5eN

  Score

  10^/10

  gozi1000bankerisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2