Extracted

• • Target

    f6622d3e89e6453c9bd3bce009eff459_NEAS

  • Size

    163KB

  • MD5

    f6622d3e89e6453c9bd3bce009eff459

  • SHA1

    7449d2a9225c533e8a31434c419fe15ccd738348

  • SHA256

    9b306082d0d5b1420df014ae1450c42a2a9c75164f9c682cbc312e08288bc8dc

  • SHA512

    5ebc935648dd42e9b3aadcfdd15ce314b07990dc016c3afebe3118b0ab054d77592a0f288fd959a93bff22c45df83a55969cab291aceadaf63b2582a1954f585

  • SSDEEP

    1536:P162LCVWD8WuvlbhWBT/C42rdugJspJSnlProNVU4qNVUrk/9QbfBr+7GwKrPAsf:dWVzdhCTa4stmAnltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2