Extracted

• • Target
    ad31fdc24bf08ff3caa4ca62cc7e0228b93c0f6ffc571f6f44ba182520d80958
  • Size 163KB
  • SHA256 ad31fdc24bf08ff3caa4ca62cc7e0228b93c0f6ffc571f6f44ba182520d80958
  • MD5 0f7ab0fd414567e38cba4f60e2cfe680
  • SHA1 f0a4ddaa0e1dfa915300b9ba657379d60fe3e231
  • SHA512 d116bbbfe9d596e7aadd11c150cea73ae1b048fbfcdcf49df25b7c08bc080c06293878448168426db411040f02a089e2314101a3ed15d3905f863828a1d037b6
  • SSDEEP 3072:2bSkUg5LLn0RMf6ADqMltOrWKDBr+yJb:2bSkUg5LLn0yf6+qMLOf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Detects executables built or packed with MPress PE compressor

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2