Extracted

• • Target
    easfawefawfas.exe
  • Size 12KB
  • SHA256 866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
  • MD5 2813b6e3ed4bd6b14c53e3dffcdff21d
  • SHA1 5ac7c7a3dadde70f94810c608a2eb275f14b7bde
  • SHA512 ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24
  • SSDEEP 192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gozibankerisfbspywarestealertrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4