Extracted

• • Target

    d810fe5f881fb999838640f8ba9dd500N.exe

  • Size

    163KB

  • MD5

    d810fe5f881fb999838640f8ba9dd500

  • SHA1

    738d68e44a9022fc8b7f130d3b8686d74ee548d8

  • SHA256

    59fe132905a289083cc7e5e67f75692766cefe91ab8c1e8e7aeb21e5cbdfcca8

  • SHA512

    74c8430ba9dab07d74ad645aa0a16cab898fcde60f29bd9dcfb36236976bdef1cc1de36d8028a4c63582846b4d792f9e8f2508bd78edabd9cfcdf251d895557a

  • SSDEEP

    3072:HFrAQb6dH8xbyUuDPfoltOrWKDBr+yJb:lUQO953oLOf

  Score

  10^/10

  discoverypersistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2