Extracted

• • Target

    44815c66de5391dd91fecf4b12b789c0N.exe

  • Size

    163KB

  • MD5

    44815c66de5391dd91fecf4b12b789c0

  • SHA1

    f9093c592d7f6070d13d91a66f54d04a34656122

  • SHA256

    45325cce22e233483dcd908eb03a46903def87ee765e24d215694102b7227b32

  • SHA512

    289bcf4cefaa6536e45d7c2045ea6f052103f07400fa53aecd20f407fcad0754fd6e6a846b388ab0de6972021ce36f191664073145cc8055aad31c1b3b7d5cff

  • SSDEEP

    1536:P3bWxuKEXi++Oor8i6Pk2lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:/b+oXi++Oor8i6PpltOrWKDBr+yJb

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2