Extracted

• • Target

    5d3941a99362f90dedff9cf60090b6b0N.exe

  • Size

    163KB

  • MD5

    5d3941a99362f90dedff9cf60090b6b0

  • SHA1

    beda9a557dd32341ea6363a5888e694a89213fe2

  • SHA256

    7cafee83d6ddeb4192f6d768b6a2ae9bf776459e556b527f50f656a2db2f2446

  • SHA512

    c628e64bd3cbd2cdab68d17923253cd2e72a06f431d00b068821967baf6dc184078db323a236e122407ff873afd8bb3afdca223faf21670b36918ff4c0ac1c7b

  • SSDEEP

    1536:P6EWN9Cdg7q2hWCwEkP6BapK9lgZ95c5mflProNVU4qNVUrk/9QbfBr+7GwKrPAS:fgqeCyopKGm0ltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2