Extracted

Extracted

• • Target

    c4306a893b5f4df70606734d8500db80eb1433202e6e83736f3d73bed7c2859a.exe

  • Size

    320KB

  • MD5

    def04259b8761a1f314b3311661f6965

  • SHA1

    d2ab227180b60863e88dfdb07cf9b43bf7c2aaf1

  • SHA256

    c4306a893b5f4df70606734d8500db80eb1433202e6e83736f3d73bed7c2859a

  • SHA512

    6ebb7043238bad952146638e82a37b434c889202fcb2f6c1a14bb5fd477efa85ae929a1d9708437a5d5ac0efde5eeb482b3d5e5e07612e990f52246dda5b5921

  • SSDEEP

    6144:tRZq3EI7T9bMrBtl8Tln0OYZn855osyIoENdwT5kD:Zq3H/9bMdtl8JA7Tu

  Score

  10^/10

  gozi1080bankerdiscoveryisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2