Extracted

• • Target

    SATANA.exe

  • Size

    106KB

  • MD5

    e98af5555d9174b86254a186db60ba82

  • SHA1

    cc6faef9e23a4ef9f4c4337fffc17c80c9ce2135

  • SHA256

    2207f4926319896f1d5b1bf2acd6d0cda56dbc47131b5fd21a7d726ba6dfaa2d

  • SHA512

    8eb26885c9699d9edb891df112e444d4a1758711ad02aa891f9483a608875b7819679ab826fa52cf803b372c6f05df6c82180775fa1bb6ca0d62acfa0020eeff

  • SSDEEP

    3072:tAKP/sv5YWxi+c98mkX9LG0fP3KxWKOqNDoutl:tcYIjXKxWRqDoS

  Score

  10^/10

  gozibankerbootkitevasionisfbpersistencetrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1