Extracted

• • Target

    5abb9c9fbba6cd88aa41d9e4cdae33d64be071ff1cd5d8d49e6c2eb14bb51a4aN

  • Size

    320KB

  • MD5

    b472dfe503d8eca0760b7a047e982ce0

  • SHA1

    d16c2dd47075c379a8ff27def6ef2bec8f0fa555

  • SHA256

    5abb9c9fbba6cd88aa41d9e4cdae33d64be071ff1cd5d8d49e6c2eb14bb51a4a

  • SHA512

    d77cb4199a67c2a1ea80fc8d32856b87b9e781a8485be8203f3d79b35b3ff9bd6d78aee6771085ae6842829768c73f75c95149a9c5447e220a7f6ed89eae7c2e

  • SSDEEP

    6144:N4Rc9la3ETNa3fEzLNsVQ///NR5fLvQ///NREQ///NR5fLYG3eujj:LTa3ETPaw/Nq/NZ/NcZq

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2