Extracted

• • Target

    7ef02dce9d2e3716ee6c153b38f6b8274d619a086668b83d30a23eb0bd4dcd2a

  • Size

    163KB

  • MD5

    5d8dc291be1ed5ff76e667ebaf120f34

  • SHA1

    b646513b0b918297043010a6187ed1c273f2e1f9

  • SHA256

    7ef02dce9d2e3716ee6c153b38f6b8274d619a086668b83d30a23eb0bd4dcd2a

  • SHA512

    558093f1b2882878b8b90968ae1d059a01bfe354793b8fee418b3eb9768a8aeb8382c6deb8301682c522d858d2db5b34ec6a0e7e1bf7a0ca3ed40c490eb2d7d0

  • SSDEEP

    1536:PrbbElqSmD+o++1E/H8C2piGCvKZ5lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:jnElqx+o9+cC7nKDltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Detects executables built or packed with MPress PE compressor

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2