Extracted

• • Target

    12d66107671eb4b2ce864fad98fda18e37240ecb759c8b3aead1c836a926f2c9

  • Size

    163KB

  • MD5

    052ba2f03f6467543333b644839c95ff

  • SHA1

    f4994128177be9ee481ec8da194953c9d5793834

  • SHA256

    12d66107671eb4b2ce864fad98fda18e37240ecb759c8b3aead1c836a926f2c9

  • SHA512

    57834bca12207d9c1205d424921979a665d3dcc015018550d96c3f112fb8d5e8139e59ad8005926700eada6e982a2116c6e32d4ada83779bd07eaa1776a40928

  • SSDEEP

    3072:JcWhPcX3hPvB1uztzeMeCBltOrWKDBr+yJb:iWouztzECBLOf

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Detects executables built or packed with MPress PE compressor

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2