Extracted

• • Target

    92d37f9699672b48a816d0da0db68167ea7f45dfd7137bb48cf6e9e36d7076b4

  • Size

    199KB

  • MD5

    b6472d999d771b922bf1c1b9e5da1c07

  • SHA1

    b346bea7343dc739dad96e78d0a6a9fbff64d3f9

  • SHA256

    92d37f9699672b48a816d0da0db68167ea7f45dfd7137bb48cf6e9e36d7076b4

  • SHA512

    fd0c5a1ead59f238fa4288dcfb08570c366ff7a5cfc4e78eca05284b7f75cb9f2fb7825064d5e2d48a9340d6c092a4605e803cb87f6f4882a510fe43dccc0cfd

  • SSDEEP

    6144:g1BpcJrVKdeOPLTlKYoT4byFgUcVydDeT:UBHMOPXljoTHPn6T

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2