Extracted

Extracted

• • Target

    36599208287637_182387937827.vbs

  • Size

    2.0MB

  • MD5

    38b6d2b8eb400e54a5382b3b4b028639

  • SHA1

    feedae24f937be7be234d213461e50f91e985e68

  • SHA256

    54663fd1d1312b20fb9ac3015ccf77ef094069c5719f5e0cdd71e8243a97a4c7

  • SHA512

    413b3bbd3367b2d414aeba286303baaf96a3ee932a0f11b9b2e1b387ce62a41c1d1a4718f235a9b7894bdf408dbb95a284ce77b464614bb8c3f4fe29367b27eb

  • SSDEEP

    49152:DfEgMVfAz54XC5ocIaev2kkjxeGsiqxfnrq4lxIeGa0KVt+1nZiLLHhyoU8:+

  Score

  10^/10

  gozi63bankerdiscoveryisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2