Extracted

• • Target

    6887886f60df1b5615fc840580183e324a24908a5de4528d191e9dc47190a7f6

  • Size

    163KB

  • MD5

    0c71e344d578f042f5ada5dee33701d0

  • SHA1

    df2e6da00479455c64f3a3d31a6bff8b8e23549b

  • SHA256

    6887886f60df1b5615fc840580183e324a24908a5de4528d191e9dc47190a7f6

  • SHA512

    648a2f114d3350d6d981a818e64c8a4177a1658d6db8860e6d23dcd9bd74874b17d899ae8d8f2eca731191efddc2b64d0a9ed56a26500bb71cb8fa5b11e2fce4

  • SSDEEP

    1536:PZOnypKk/dRIz14/VPKWs4QCFbr/lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:gyIk/daz2/VP9Znx/ltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Detects executables built or packed with MPress PE compressor

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2