Extracted

• • Target

    c4e4283efbca39f4e807667811cf9017887d6254be8a41148cd0ab7517b5a8ed

  • Size

    163KB

  • MD5

    acc8339588cf6945181b8f13085d156d

  • SHA1

    69d88f424040b2908da2c7f5a0e4bb4c05b35253

  • SHA256

    c4e4283efbca39f4e807667811cf9017887d6254be8a41148cd0ab7517b5a8ed

  • SHA512

    67b65f161051f51f7646f8e7e16a5e1ebeaba11d430bba8df3d780f4094047698d36b6af30bd70412b20725c2dc689884388849ec66d2be4abd369e9fcc728a4

  • SSDEEP

    1536:PguekdY2yqlFcTz8VMuXwNTMJdpFjlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:ISYTkCibJnFjltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Detects executables built or packed with MPress PE compressor

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2