Trojan:Win32/Gozi.RD!MTB (file analysis)

The Trojan:Win32/Gozi.RD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Gozi.RD!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Uses Windows utilities for basic functionality
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Attempts to modify proxy settings
• Deletes executed files from disk

How to determine Trojan:Win32/Gozi.RD!MTB?

File Info:
name: 354E98CE756EF4DF85F6.mlw
path: /opt/CAPEv2/storage/binaries/65d74dd305cbb05d1a6f52b00a5c9b358d78fbe6cfb4475ccc96a6173e0e2606
crc32: BC07B99B
md5: 354e98ce756ef4df85f6ab1750d366b7
sha1: 6baa0ad618ef165ad96c5a62e4bcb14bccccbe28
sha256: 65d74dd305cbb05d1a6f52b00a5c9b358d78fbe6cfb4475ccc96a6173e0e2606
sha512: b64c158a06231c942c569bc73b8210d19ce47bf76871703c7f5bd0b17c77edb43a0a2f7c82d09a5e9c9767473ecf5820409b2e2b8d7e8d308ea8741dcf9f8e2d
ssdeep: 3072:A9E4Wgbr57BVFqmx1E9Hqmz674Qbf6xET/nhqCoNWDY1TuDBujfgY1LRQBAhHuca:C0MJBVlx+Vf274Q2xqhxoNH1Ti5Ytuc
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E304128949F42929C76BF832CD3817845880967BF7A482A451E4F46A36F95BB48FCE30
sha3_384: eebc86264382897b60bf67674b8348c22084bb8f0fdfa0ecc7f1600b93da4dc1f4a68798061797dd17f230678eec8de9
ep_bytes: ff1528c04200a300d04200e8ddfdffff
timestamp: 2022-10-08 21:19:46

Version Info:
0: [No Data]

Trojan:Win32/Gozi.RD!MTB also known as:

How to remove Trojan:Win32/Gozi.RD!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.