Extracted

• • Target

    eac549c7b10cbf33ff16b54023f54cd0N

  • Size

    361KB

  • MD5

    eac549c7b10cbf33ff16b54023f54cd0

  • SHA1

    b3046b869d965c3aca95dcb0f091f51a916fab81

  • SHA256

    3efad46de8b6fdf2a69850f93653170310419c211f1c7bf7ec6753a26e69db07

  • SHA512

    26e117ebc45226aaf3c8a735cd2d810ede0f61e3534ca970aa4028bfdf1ef919d37e2bbd5e628e7d51c617b8b54e186e0d14375bd0ea513a584c4048fd3f402a

  • SSDEEP

    6144:nVSFLsVQ///NR5fLvQ///NREQ///NR5fLYG3eujPQ///NR5f:ns2w/Nq/NZ/NcZ7/N

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2