Extracted

• • Target

    7d238dc7319fc3ca01ce77323181fc9af43aaa5869137d5ae7eb372a5c7c66c6

  • Size

    163KB

  • MD5

    c3bf2ef482e36e9a45e500ce82e8f5e2

  • SHA1

    678776af89a904a0e8df63a7eb8d078f5833817c

  • SHA256

    7d238dc7319fc3ca01ce77323181fc9af43aaa5869137d5ae7eb372a5c7c66c6

  • SHA512

    1c851a1c8d8f3df99e2ff16d516cead30544be95812e31db50d1a389465a04cab3b79a4bf13fd797a8792ae04bed2a2af831e70c1336c4cc889de496d63417e1

  • SSDEEP

    1536:PecG6maNzAFT1UItqM0g0JaOvXgTFelProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:lmamluIH0MmgBeltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Detects executables built or packed with MPress PE compressor

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2