Extracted

• • Target

    4daa41fa1fe72f7cc68c4f07333ea8c0_NEAS

  • Size

    163KB

  • MD5

    4daa41fa1fe72f7cc68c4f07333ea8c0

  • SHA1

    dd43c59056c5639327f6f696d76c3bab8f24ae6c

  • SHA256

    9a8989df117781212e4e40afab5ae10cbbec5724f8a040c7a57c1d7d8c28c660

  • SHA512

    a9a8d61742529885fc742cabb802e09d7d6a9a61b00d0edf046f6c493a54ad5c5119421c95573af257ae71138cdecfd24c76381a94e79c92434b9ab074981cb4

  • SSDEEP

    1536:PG8Pr+O5TPplQ5kjpG8rR793BVWCIMYiKlProNVU4qNVUrk/9QbfBr+7GwKrPAsf:e+CO5Tpjcc9ZKltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2