Extracted

• • Target

    72a3927017a698813a6ebad6e603f5c0N.exe

  • Size

    163KB

  • MD5

    72a3927017a698813a6ebad6e603f5c0

  • SHA1

    68871a523cb5a686e043fd8b48408caac2150a8b

  • SHA256

    e2b1777d6ba9aeac4101580777d4902863951e469046325b120e5ac0031aa866

  • SHA512

    c34063abb20411eeff9069c031d241022b38803f8422303068e81afe777f7e8cb507b33bad4d3ae902019cef14668d84dfc4bd94cee086e9d7886dd3bd987ee6

  • SSDEEP

    3072:ZEhAdQJYrAW8nMLK1BultOrWKDBr+yJb:OhA8nn/uLOf

  Score

  10^/10

  discoverypersistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2