Extracted

Extracted

• • Target

    infectedmars2021.doc

  • Size

    4.3MB

  • MD5

    0c8555a71a055a1e553ffe8865cb3ea6

  • SHA1

    a8e77218bdb915adec62580f95d3a8a679b18215

  • SHA256

    2a7811607023a04ca559e46d7106588f4542af11352972ff84d28b49e59d4507

  • SHA512

    ebd784a06b35e8affee01c16f599bdb99336ee5d720e540a56b550579b201d0a04d030cc412b9a120158e5c2ec5bb8e2c5b71fcc810c117f8c290377c87973a9

  • SSDEEP

    49152:oVUg5AfUb76jl/PTV0maWj4qO4eiJbFFYRKFZW+sYzbtqrDpee26:o6gF2jxPpbaWjRnuv

  Score

  10^/10

  gozi5513bankerdiscoveryisfbtrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2