Extracted

• • Target

    fe820198efd347a19d5ecaea6473d7bd9ee0243c5a859de52018a90dd8f6e538N

  • Size

    320KB

  • MD5

    e68399e75be4662c336e08c07b4c9f90

  • SHA1

    44ecebfb0b9b0c4f10e018009df151c0b9ef2ac1

  • SHA256

    fe820198efd347a19d5ecaea6473d7bd9ee0243c5a859de52018a90dd8f6e538

  • SHA512

    a334693404a41ea896350a7c325e05a8525349d315013f22c067721806e62d2b63410c27f5aadabfd312da9cd82683c30d522feb59081fcf023ef1d14903df7b

  • SSDEEP

    6144:0A+mYZybasVQ///NR5fLvQ///NREQ///NR5fLYG3eujj:B+wJw/Nq/NZ/NcZq

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2