Extracted

• • Target

    7c7ba94281aff39ec4a493575e394d76f3f198d6ecba8cc4457d41d0da8e340d

  • Size

    91KB

  • MD5

    685403cb101fb109846fc08743c34d9e

  • SHA1

    308996254958dbb83bc768873dec55f7323fb35d

  • SHA256

    7c7ba94281aff39ec4a493575e394d76f3f198d6ecba8cc4457d41d0da8e340d

  • SHA512

    54235ae168dfd55721032f049eb876d004e1f4ea7704a99be46cd0754f6bac8da0b9adbe6598d873c4501bd6599a2812ec82688468dd6ce0c647e5b2bc44f8b6

  • SSDEEP

    1536:IFAutcCNS1mgnd2y1nrPlGiCcCBEulwhFAutcCNS1mgnd2y1nrPlGiCcCBEulwu:IpWC4YgBPlGiyllOpWC4YgBPlGiylll

  Score

  10^/10

  gozibankerdiscoveryevasionisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Modifies WinLogon for persistence

    persistence

  • Modifies visibility of file extensions in Explorer

    evasion

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Disables cmd.exe use via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2