Extracted

• • Target

    ae3b640649579d4549db5b81aeb5a174d2f2dee8d3198492ed9a224e195cbec5

  • Size

    163KB

  • MD5

    39ff46b7ffb69c44e3d56dd2a1984e3d

  • SHA1

    f27c7274e095507ebc7e7fa8f5514c4e3102dbb9

  • SHA256

    ae3b640649579d4549db5b81aeb5a174d2f2dee8d3198492ed9a224e195cbec5

  • SHA512

    5516bc2af3adcbc9718835b7dccb555d3eb4e72a05047cb91bba610d4cb936760bf14c4221c7b3b6fe03bd35106a937d278c19df5b9c6a00d034407b55d15328

  • SSDEEP

    3072:Pz+2/349CT69/cnUEPsltOrWKDBr+yJb:Pq2/u9/cvsLOf

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Detects executables built or packed with MPress PE compressor

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2