Extracted

• • Target

    baf338da1c3c2987b1bc254abb0c7e40N.exe

  • Size

    163KB

  • MD5

    baf338da1c3c2987b1bc254abb0c7e40

  • SHA1

    9806bd3697815d2e0fb7dedec527a5b0cd522671

  • SHA256

    865580559c710d8aca5ee43ab1b7ce6da6fe0414d51a7b2b0aaec41205d688b2

  • SHA512

    6b46e083fe8e6353d4ab8105c808ef4bd1c37c2270d7a6e3e008c7367f16e9437fdf6c7305ac252a0267857321f10701a92836631679618c21deb9b74fc16361

  • SSDEEP

    3072:ctcT7y6Y6KO9PzkSHNw9PjwbCltOrWKDBr+yJb:ctiZKO9PYStw9wbCLOf

  Score

  10^/10

  discoverypersistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2