Extracted

• • Target

    loadre.exe

  • Size

    11KB

  • MD5

    5e11511f8c86bd3670d94ff9df0a4b50

  • SHA1

    b818702166d30936ec30a3ee5485325c140f9323

  • SHA256

    09e10f9ecb7c6e3d94302619b6b265ba688a448be06b1da898e73b54c5505f84

  • SHA512

    4ed042ee76d870c46d9de9dae7a063bb28aa3a1f31de6db6933600ad5602e982b1eb13efc471d886cd5a147f746708aa46a437e89c3f7316a7d8f6176ff784b5

  • SSDEEP

    192:5k8Js2ZtezIgMX3dYeydFntOJ3wIksunO5425:5karmIgMX3dYeydFtOJ3wKuq

  Score

  10^/10

  gozibankerisfbspywarestealertrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1