Extracted

• • Target

    SecurityHealthSystray.exe

  • Size

    12KB

  • MD5

    bcd5a9678f98f90f3353895a4652412d

  • SHA1

    c28dc10d7ee2772bf66022863351806c9c843b1a

  • SHA256

    1506bc26e98fc87034a0ef3a39a1192fbd8ef2336e375eca6c1ceeffe36a73a3

  • SHA512

    6be5212588dacd4f3f71260b1991ffa7f164745fd89ae3474b65120c52dc8dcb1ceaf79c54ecb5ae2bc50e5959d0fe318ea76860e8d6245c7f86d45dfbde367a

  • SSDEEP

    192:Ks+iDcpjWW+nmpfDAQ3dtTzeihOfm/k+sqnINNe4+OlI8JWsRI5:Ks+DpjWDmpkQNhNhfPnkw4+OSRN

  Score

  10^/10

  gozibankerisfbspywarestealertrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1