Extracted

• • Target
    0fe1abbc7e54811754b072a177551ad257b4b65d67e0d40c61dce73660b50691
  • Size 1014KB
  • SHA256 0fe1abbc7e54811754b072a177551ad257b4b65d67e0d40c61dce73660b50691
  • MD5 b12b48c1ca8ab7d97600e0ec3aeab4c8
  • SHA1 16a2f2b949a4872f78a18ef5abd16815da5bfed2
  • SHA512 2cc1abfd7da434cd89e89ec84a005b24f396aff15e8d54e6a157905e4ad7d38db49c03ec4ac7572d9324318dcababe6d18fd9480b740d959dfa670b5043ae435
  • SSDEEP 24576:fQ1lIIAJFPFW/g+QpY4Bnw8aEOo0+YyQQQQQQQQQQ+QQQQQQQQQQQQQQlQQQQQQ1:KhAJFP4/yc/1oWyQQQQQQQQQQ+QQQQQK
  • TLSH
    T145256B11F1B2F03ADD96C0FD86FB937A582C9B254B94BCC7A2C44D6E6B103D1B671289
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdiscoverypersistenceadwarebankerdefense_evasiongoziisfbprivilege_escalationransomwarespywarestealertrojan

  • Family: Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Checks for common network interception software

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    defense_evasion

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Drops file in Drivers directory

  • Looks for VMWare services registry key.

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks for any installed AV software in registry

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2