Extracted

Extracted

• • Target

    1ae8af8836a1b444a827766d3d2f217bf5ef8c6907d5536a4ef32b36bf60c274N

  • Size

    226KB

  • MD5

    b5f43eb4ed44b642c2c0c4493ae98d10

  • SHA1

    ca30743516b6be257b1b90030a37992d01cffc2e

  • SHA256

    1ae8af8836a1b444a827766d3d2f217bf5ef8c6907d5536a4ef32b36bf60c274

  • SHA512

    b4d0cae3b5f008c68854e316a8975361a8130c850c6ebcc646c015c60e4d7894f1a69366bf027b6954c445179b08f0893fe22faf3a120ea7aabdbce74d37d882

  • SSDEEP

    3072:TM5gEFogWzADDTDKcWmjRvDKcpDKcWmjRrzNtQtjDKcWmjRrzNtb:TggJOcxEtQtsEtb

  Score

  10^/10

  berbewbackdoordiscoverypersistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2