Extracted

• • Target
    install_msl008.msi
  • Size 8.6MB
  • SHA256 9a217232ad3d2b557e7334d1da50fa4bc72efabb99ce110fa87597d87e420c3e
  • MD5 50f2d0b3da8e3233c769b7e4b1ad9997
  • SHA1 ab953cdd89514335c2b47f896e2879754b760dd6
  • SHA512 8bdb15eb25e9ab309cdc90c925ea6a981d9987191ca9ad039889ad06817d581dc57a9563314e2ef242c1545e1b0635496b6d447d9321ad9e0594f466c38af678
  • SSDEEP 196608:Makv7IcwphcawL2rUCT4BJVA1yKWckNVuSUXIdr/L+GXhoEyY/XWG:MakvMcwphcLL2rUG5Wcm52Yz+UoEyYl
  • TLSH
    T1999633927D863BF3C547CF749191262DBEA8BFC5AA359E097AC435001E7272A173730A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdefense_evasionexecutiongoziisfbpersistenceprivilege_escalationransomwaretrojan

  • Family: Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Windows security bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2