Extracted

• • Target

    c76eef70afbbd89225fa06ea8e626e20N.exe

  • Size

    163KB

  • MD5

    c76eef70afbbd89225fa06ea8e626e20

  • SHA1

    c368d129a1da1535f1c3933d6750123ddd75950d

  • SHA256

    0204afd0a9ce97230742aecc73d62eb15f275e9874e4bc0cb359f8aca39c7b80

  • SHA512

    e48dbd2e3f9153c89b4889bf0538843df686c0699333e33f2294c711f174a80d6c783dec9e880ee234a7c98a8c5ae9418a3563e1b9a0fee9c2e88e935b45f43a

  • SSDEEP

    1536:P03jh5IdWMw/mYYom8pCrfICZyRBzAlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:QXqweH8A7IOeBzAltOrWKDBr+yJb

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2