Extracted

• • Target

    35db2ace7ee4462430927fd34f92c4da8fdd62bde45c15e23ded256c64deeb10

  • Size

    163KB

  • MD5

    cd639963f54893d78247a9ff777cf94b

  • SHA1

    88c2228167b85f1ae685603e941f4f1083571476

  • SHA256

    35db2ace7ee4462430927fd34f92c4da8fdd62bde45c15e23ded256c64deeb10

  • SHA512

    84d33c6d9738d17ad3da5f9c59151bc2bfc98591074898d84d6583b22032abbc3d50572b3bdab2bd7a87447a64a3a18227b203294812139c4e3eae7c3e0d3697

  • SSDEEP

    3072:oCxoq3rA5U5ohuVxxXHltOrWKDBr+yJb:frk5U5oOx3LOf

  Score

  10^/10

  discoverypersistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2