Extracted

• • Target

    a1ad37ee2c8eb01117c034a0ec29cd30N

  • Size

    163KB

  • MD5

    a1ad37ee2c8eb01117c034a0ec29cd30

  • SHA1

    653a658f5884744d81cd2c277e365a424ee60c66

  • SHA256

    a85a8fcd6c339dfeea9592365dd6973ed0e48130e4b8f14b79d0d38250ef03bb

  • SHA512

    73622853882c26ff158d0a8614d4881d0357675315f106c51ebb12997c224d1581e1da67f90dcfa978dc8ef901b93eb8989c08211c99f245ecef90570e7bb4f2

  • SSDEEP

    3072:re67LYKNyK+NYwxAhYDpltOrWKDBr+yJb:re6IKJipLOf

  Score

  10^/10

  discoverypersistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2