Extracted

• • Target

    bbf716f822b8b0ce108ce29dd053e5f0N.exe

  • Size

    163KB

  • MD5

    bbf716f822b8b0ce108ce29dd053e5f0

  • SHA1

    6cc21f2e31a42bffe7e9464c98b2ea85f78eac5d

  • SHA256

    4c2fc28e8191d168a496f40dd20f0836c317f88558d776ec97dd76f1f59ebb90

  • SHA512

    ed6b20b22838924f2112056c7043725af7fe128b60956d114e955eb2c8bc9dd4b6fc7c54d6d619532dd3437aa3355a826bdaec2a4961050a2f1d02c62e2d6b9f

  • SSDEEP

    1536:P1UH6O36P2PmNKN8D/gKelProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:SH6Q6PWYwwoHltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2