Extracted

• • Target

    Multi Flash Kit v.4.11.11.exe

  • Size

    154.8MB

  • MD5

    16bb6020b61440318452fbd3afddb5fa

  • SHA1

    bcf98da8d742ea1d62cdb35e9d3d302925da93fe

  • SHA256

    b67c56c28907408cf73bd7a1dbf7d827700500a6eb3899dd92cead3ab56e81b7

  • SHA512

    0feb99209e7018ca0a324311a235398ab2476aa8dbfd69a029082b4807705ca776959a79d5a2adf0439259cc5c685056ea9af47ff1dcdeffbf84ba6b53361856

  • SSDEEP

    3145728:o1bOLj9uGkxoMDpWjhqOfH8V+VV3V46D2ONovKMWoJRfkP1KVhdX6kJ:o9OP9uG2BQjPrV4E2AoCMWSkAVDXp

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1