Extracted

• • Target

    003659076246b0c43675bac90f854640_NEAS

  • Size

    245KB

  • MD5

    003659076246b0c43675bac90f854640

  • SHA1

    d0ae2da08e9cbe9b983211b28843ae5c5dbbee03

  • SHA256

    bee71fee94c43bcd557925c4c859fe12fa5afda231659c314bc23fe469279484

  • SHA512

    2c35d01d74aeff103d2fdd2dcd0e304b0b8c7d3f60abee8179d242fd22e091d3e1db63d3264cf89a8a860b7298174db781dfa404df8bf57c361d3ee06ee66626

  • SSDEEP

    1536:YsFgfD76ec9wYA2HfwB293kbRbIvWAljFB4Se/4cXeXvubKrFEwMEwKhbArEwKhr:tgfD7bawOI2wDIjPzewago+bAr+Qka

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2