Extracted

• • Target

    21e14ffc365273b956e176844f2435b571f37eb81a1e571308537b9f9ef88391

  • Size

    163KB

  • MD5

    2137ef742d12377c9942d0f885706b08

  • SHA1

    bda09bfff8e2feb4f389a3038543f8a45a41d358

  • SHA256

    21e14ffc365273b956e176844f2435b571f37eb81a1e571308537b9f9ef88391

  • SHA512

    0cd98602bff81e068ce13c9f6486601c34647897d603ee188d94322d49ea6c821df2de72b09f2c3f5140e7d1d3e29190ebaa64a3fa73c6c78c44eee606073b9d

  • SSDEEP

    3072:/2r4q/0U64WFO7y7Z/SBmltOrWKDBr+yJb:/2rN/7D7y76mLOf

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Detects executables built or packed with MPress PE compressor

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2