Extracted

• • Target
    0a41c1ecc8472698f90f0c43b4c642dbe31dd98d1f99a86a22351337e1fcee2e
  • Size 2.0MB
  • SHA256 0a41c1ecc8472698f90f0c43b4c642dbe31dd98d1f99a86a22351337e1fcee2e
  • MD5 eddf80d604b19b4bb610737350a1657e
  • SHA1 47f5bb052b66722df60b25f5962b231eff51c7fc
  • SHA512 5eebcdba1f7d24dbbb2a1d63dea9c4820407ae7ecc2d63aaf344baeb8aa96aa40c264e513b1fe919a216f1b24d5ca3b72a83400866a5b974a9ab84763cabdcbd
  • SSDEEP 49152:S+ggKOb+Hqoo3gU9DPjOP+9Rq1S78nCrPyRPVaqeZkYcer:Dg2KK3z9OP+9Rqc71kV8ZV
  • TLSH
    T145A5E01B3A91883AE0724130A96DA328D1BAF8315F72854BF2D5571D1EF56C3893BB37
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdefense_evasiondiscoverygozixmrigisfbminerpersistencespywarestealertrojanupx

  • Family: Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • UAC bypass

    defense_evasiontrojan

  • XMRig Miner payload

    miner

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1