Extracted

• • Target

    b649a883dfc98e9787437836c85b40f0N.exe

  • Size

    163KB

  • MD5

    b649a883dfc98e9787437836c85b40f0

  • SHA1

    b1bfd8d181d17990c2a0cb9703c1c0c717f51f47

  • SHA256

    1455ac1e000c7e55e15fc44504c4d561e5348eb2bf763100bb3fac6d656ee7a1

  • SHA512

    b281181dbc736817c962b831c6d21c07a7b43e0a47d93ceb1adcff47d10cd9613b3d1a7460dc9b677070e3c1e6d7ef622db251a6bf97ee2709f250f3d544105c

  • SSDEEP

    1536:PyVEvZRq/FgBfs76AsGRh4tphBvrlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:GyR2F2fs76AsGRhm3rltOrWKDBr+yJb

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2