Extracted

• • Target

    612ca58bb7ece9f718c50b99f21442af46b170916477f7c1a7196f90a36d8776

  • Size

    163KB

  • MD5

    dd8c297734dfcaf15923f785397ba20e

  • SHA1

    d53ec458320f2c055adb8a3b367e5f1fe7047dab

  • SHA256

    612ca58bb7ece9f718c50b99f21442af46b170916477f7c1a7196f90a36d8776

  • SHA512

    6ad18419cb65473a38537d2f6adf5f044beda8ed10e28986d19c73b2343896f9072b37bfb4f6a1b8194e396e18919a1edf4a6f3153617920657b3c83f0c0bb81

  • SSDEEP

    1536:PSAAiXz15NxQSZGufHf6Qq5t2BRYBqw7lProNVU4qNVUrk/9QbfBr+7GwKrPAsqE:KAAiX55KQqCYgw7ltOrWKDBr+yJb

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2