Extracted

• • Target

    0b9b1f5f497c43b9a4d92e8572505d43963cbc5389e0bdff2b02490aadc9cad4

  • Size

    163KB

  • MD5

    4e435d2876c587413e0b0ef801cac057

  • SHA1

    f8aa67217862fe4d1b95436e47bf40c7872ceaef

  • SHA256

    0b9b1f5f497c43b9a4d92e8572505d43963cbc5389e0bdff2b02490aadc9cad4

  • SHA512

    13763aef1ddac4865ca63643471a5df5b258f37a09b71c0cd50c999aa1a6e292aa8b6267da81442f09bf724160512ccdb3d74f09348eee44e158ef8d2e2d9ca8

  • SSDEEP

    1536:PY7Mv3FsqJNvVliJTqvU1Xr8xRoKlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:Q4v6q7vVliJqvU1YYKltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Detects executables built or packed with MPress PE compressor

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2