Extracted

• • Target

    ec0bf36c56521de002a605ef296c38e5b37d4873a3d40a005f879896b3e34a2b

  • Size

    163KB

  • MD5

    91ecced0c4fc9ec13aa89d57177bb190

  • SHA1

    452d4884f41eb06dded8a15ebd5a13d3c0ef5cdb

  • SHA256

    ec0bf36c56521de002a605ef296c38e5b37d4873a3d40a005f879896b3e34a2b

  • SHA512

    989b00fbbb52713b3648f1d63318934221227e7bf28a4d434ed7d137bdf48bc1ef710a565c1e291bc504841e780c2c6ade3b70cffdb04189dce0e3e86ddef76d

  • SSDEEP

    1536:PjrVOvSFVg6ya2dvOvkE1mIgrMKlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:7rE+V09dOdmIgrMKltOrWKDBr+yJb

  Score

  10^/10

  discoverypersistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2