Extracted

Extracted

• • Target
    Generale_Informazione.exe
  • Size 708KB
  • SHA256 4fddc495d84c3b30397b2e3de7cdad79d322de9df03fa00bf792f6106a06a06f
  • MD5 4eeb4ef9baa950b337e128ea45f2a902
  • SHA1 af73ad6f099c389bfd3a271f94173e9aca84bc48
  • SHA512 1ae3aacb191daa5d2c9b0dca832658cdfa32563b6b0a3e1714923dc28738988b9fce91e733a5d5a5ef3ea3bb7a616a8f37d3aa3ef48d3597dd7c44c45b13ccf9
  • SSDEEP 1536:srae78zjORCDGwfdCSog01313js5gccF8OlntFdMBgtjw3r74D7eAOqJJot5pVOz:0ahKyd2n31I5KPlntkBu7viRynTuPY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  persistencegozi7706bankerisfbtrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2