Extracted

• • Target

    8ede945ec0fbf155ea7a2b6c6e9565f0

  • Size

    339KB

  • MD5

    8ede945ec0fbf155ea7a2b6c6e9565f0

  • SHA1

    cff40f4ba3a1eeae907dfd1c1b6f94581a47b00c

  • SHA256

    de337579df5e30ab1afc24a28fd0426c5c59d496c16657f9b8012cb4942b4ca0

  • SHA512

    bbfbc9a358ad980c809afd5d9e3c8f0a5e054af9862cf0a896e7ce4a96db060e7650fed58dcab89aab9b3481c8e9e6e270de2f20133dea37955e5248347b8c56

  • SSDEEP

    6144:brA5wVdCy6wrbDY0rDqTWC4zEDzKuTrSbxc97cx9YtQpmZeQBqBP9Db5HS981dER:Xjyy64VrDqTWIzW+9Yk2iA5lyqu

  Score

  10^/10

  gozibankerbootkitisfbpersistencetrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2