Benign Download

Trojan-Banker.Win32.Banker.oza

Image list icon size importExecute shell command (ShellExecuteA)

SHA-256be8a9b88ab5feaa29228a41aca736d1f3184e699ab7a31b4cbfce668cb3d735c

Evidence

Query/set system parameters (string) 0x6c2ea–0x6c38a

0x6c2ea6765000000005472616e736c6174654dge....TranslateM
0x6c2fa4449537973416363656c000000005472DISysAccel....Tr
0x6c30a61636b506f7075704d656e7500000000ackPopupMenu....
0x6c31a53797374656d506172616d6574657273SystemParameters
0x6c32a496e666f4100000053686f7757696e64InfoA...ShowWind
0x6c33a6f770000000053686f775363726f6c6cow....ShowScroll
⋯5 more rows

Query/set system parameters (symbol) 0x6d430–0x6d520

0x6d43039314f3166317b31b53141339f339b3591O1f1{1.1A3.3.5
0x6d440fa350e3616362c364436523666369a36.5.6.6,6D6R6f6.6
0x6d450b636c236d636e036f336233750375937.6.6.6.6.6#7P7Y7
0x6d4608b379437c937d037f2374938d538e438.7.7.7.7.7I8.8.8
0x6d470ed3816391f39513958397839c7390b3a.8.9.9Q9X9x9.9.:
⋯11 more rows

Execute shell command (ShellExecuteA) 0x6d604–0x6d7c4

⋯12 more rows
0x6d6c4f634fe3406350e3516351e3526352e35.4.4.5.5.5.5&5.5
0x6d6d436353e3546354e3556355e3566356e3565>5F5N5V5^5f5n5
0x6d6e476357e3586358e3596359e35a635ae35v5~5.5.5.5.5.5.5
0x6d6f4b635be35c635ce35d635de35e635ee35.5.5.5.5.5.5.5.5
0x6d704f635fe3506360e3616361e3626362e36.5.5.6.6.6.6&6.6
0x6d71436363e3646364e3656365e3666366e3666>6F6N6V6^6f6n6
0x6d72476367e3686368e3696369e36a636ae36v6~6.6.6.6.6.6.6
0x6d734b636be36c636ce36d636de36e636ee36.6.6.6.6.6.6.6.6
0x6d744f636fe3606370e3716371e3726372e37.6.6.7.7.7.7&7.7
0x6d75436373e3746374e3756375e3766376e3767>7F7N7V7^7f7n7
⋯7 more rows