Overview

overview

10

Static

static

7

a1377cd4ce...17.exe

windows7-x64

10

a1377cd4ce...17.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1377cd4ce5ce56d3823fdb57c140b17

  • Size

    2.7MB

  • Sample

    240224-hlyq1scd96

  • MD5

    a1377cd4ce5ce56d3823fdb57c140b17

  • SHA1

    86bbde799c45970f361bc77bd738a29cf9e8557b

  • SHA256

    f37a3c6561b111a616e9ae9dc30dc173bbbf5684a7a8f5b49499018eb7e0e31e

  • SHA512

    7ac5de2e90a05618e6d0f1c58e9ce017f7d60e22b0dc0afb708c2c91de7270f0f3c0d31951f5354ac92a6da80a5ca201a8213f9c807c32093a39f3e6e98edb4c

  • SSDEEP

    49152:ByTjTlwhAi1YoGQ/ara3umGWUda3VfrrER9f+oyQKvBTNDygOm9gc2pU7mbg2dRt:UTH6L+vHhsr4HGkCBygORc2ptldHj

Score
10/10
gozibankerisfbtrojanupx

Malware Config

Extracted

Family

gozi

Targets

    • Target

      a1377cd4ce5ce56d3823fdb57c140b17

    • Size

      2.7MB

    • MD5

      a1377cd4ce5ce56d3823fdb57c140b17

    • SHA1

      86bbde799c45970f361bc77bd738a29cf9e8557b

    • SHA256

      f37a3c6561b111a616e9ae9dc30dc173bbbf5684a7a8f5b49499018eb7e0e31e

    • SHA512

      7ac5de2e90a05618e6d0f1c58e9ce017f7d60e22b0dc0afb708c2c91de7270f0f3c0d31951f5354ac92a6da80a5ca201a8213f9c807c32093a39f3e6e98edb4c

    • SSDEEP

      49152:ByTjTlwhAi1YoGQ/ara3umGWUda3VfrrER9f+oyQKvBTNDygOm9gc2pU7mbg2dRt:UTH6L+vHhsr4HGkCBygORc2ptldHj

    Score
    10/10
    gozibankerisfbtrojanupx

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks