Extracted

• • Target

    c5292f8d37b75bf9cf7b51fd472a6050_NEAS

  • Size

    163KB

  • MD5

    c5292f8d37b75bf9cf7b51fd472a6050

  • SHA1

    ee1e7469166fdd09e95732c588ebfa95d8434783

  • SHA256

    c4bc5834e01ef7bcac8446c4bc80c2bef099695d661c1bf4b52c13f97dae61bc

  • SHA512

    5fe4b668452953feb8b3bf24813f8e3c33238fea53f046e9bb9750d173bddfb278bd53dac211a9d4f43c6a88e0c0ba1f6efefcea169d352c7aec43cd9330c191

  • SSDEEP

    1536:POwzik+tUnntQmXyQ0slProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:6tkQmUsltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2