Extracted

• • Target

    86577b894357de616a8b7258f73aae92c570a8217431f28d371b4a869ebaa4bf

  • Size

    163KB

  • MD5

    d8822826bb158c105b65616a089f2ca8

  • SHA1

    0fce4387d23027b07142f6e3553fd0304d1b66c4

  • SHA256

    86577b894357de616a8b7258f73aae92c570a8217431f28d371b4a869ebaa4bf

  • SHA512

    8682cbfac96627e4888c8f81d6f239f2f7b0c76c4b2c762786ad8e550e3ffee9e1bfa9146bc54aed552e31e12b7faa38290323e15639be53435083febcf43ca2

  • SSDEEP

    1536:P1D2NEJMbcbviWFX97PXpyAnOlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:t1mbaiWFX5PXpbOltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Detects executables built or packed with MPress PE compressor

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2