Extracted

• • Target

    415dbd5a40a687625f00b2bdcc38eec34f12e23bc89e435dab7a933b50da0700.exe

  • Size

    163KB

  • MD5

    d8bdcf9724941c5d9ffc59f343b57419

  • SHA1

    6f92877d19a8d710c4881c6777e45ff5812f62df

  • SHA256

    415dbd5a40a687625f00b2bdcc38eec34f12e23bc89e435dab7a933b50da0700

  • SHA512

    8470468cbb4861e888213262da6d6895e96372a947e2ac7c1178513c3bbda20ed8cae53ce3dc2260843173f3aa0c99b53b7399665aacb922e0a315d7accc07dd

  • SSDEEP

    3072:wkLl+YL4fQZ55ZpFSZEltOrWKDBr+yJb:wkh+YL4mLQZELOf

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2