Extracted

• • Target

    57f699dac83811c7f7bb8ca2cbfdaa20_NEAS

  • Size

    163KB

  • MD5

    57f699dac83811c7f7bb8ca2cbfdaa20

  • SHA1

    b4c1dfdffef4ba21b9de50b227c1507f31413055

  • SHA256

    31b27ca3cbd86c17b151bb164f575cc46b4cff5873315716df22ce172b8ef39b

  • SHA512

    fff425847c5fc4c95819809321b82996153cf5dabf8e9f95e33c7cb466318452755b873dae91f34f2cf446b9bd1c1e0f6d00f2c92bd69105310e5bd355d04743

  • SSDEEP

    1536:Px0IxklFP0+PbRspg/SHieECyuSlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:Z9SlZ0de/SCe0bltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2