Overview

overview

10

Static

static

3

Multi Flas...11.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Multi Flash Kit v.4.11.11.exe

  • Size

    154.8MB

  • Sample

    240517-md1mvsdd9x

  • MD5

    16bb6020b61440318452fbd3afddb5fa

  • SHA1

    bcf98da8d742ea1d62cdb35e9d3d302925da93fe

  • SHA256

    b67c56c28907408cf73bd7a1dbf7d827700500a6eb3899dd92cead3ab56e81b7

  • SHA512

    0feb99209e7018ca0a324311a235398ab2476aa8dbfd69a029082b4807705ca776959a79d5a2adf0439259cc5c685056ea9af47ff1dcdeffbf84ba6b53361856

  • SSDEEP

    3145728:o1bOLj9uGkxoMDpWjhqOfH8V+VV3V46D2ONovKMWoJRfkP1KVhdX6kJ:o9OP9uG2BQjPrV4E2AoCMWSkAVDXp

Score
10/10
gozibankerdiscoveryisfbtrojanupx

Malware Config

Extracted

Family

gozi

Targets

    • Target

      Multi Flash Kit v.4.11.11.exe

    • Size

      154.8MB

    • MD5

      16bb6020b61440318452fbd3afddb5fa

    • SHA1

      bcf98da8d742ea1d62cdb35e9d3d302925da93fe

    • SHA256

      b67c56c28907408cf73bd7a1dbf7d827700500a6eb3899dd92cead3ab56e81b7

    • SHA512

      0feb99209e7018ca0a324311a235398ab2476aa8dbfd69a029082b4807705ca776959a79d5a2adf0439259cc5c685056ea9af47ff1dcdeffbf84ba6b53361856

    • SSDEEP

      3145728:o1bOLj9uGkxoMDpWjhqOfH8V+VV3V46D2ONovKMWoJRfkP1KVhdX6kJ:o9OP9uG2BQjPrV4E2AoCMWSkAVDXp

    Score
    10/10
    gozibankerdiscoveryisfbtrojanupx

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks