Extracted

• • Target

    daa0406306e3405865900bfc824c2bee059f1e93cb8a3daf9b6c0e1a509507cc

  • Size

    163KB

  • MD5

    6e3fdb4b057a3478a43bcd48721b7b89

  • SHA1

    711753d8be84cae7bfd7cfff484c472a9a98073a

  • SHA256

    daa0406306e3405865900bfc824c2bee059f1e93cb8a3daf9b6c0e1a509507cc

  • SHA512

    c09fd5446355df9b63d2f8ce352ff3a922624a21903d240ed5b2f2514bf92e0a70ba8b820d9f32997285ecb183250e8073167df040a5b4c2853e807f86217680

  • SSDEEP

    1536:PazTOXWIAhXCOpbwzQyrDwb09b39y7lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:izTOyNCOp7q52ltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2