Gozi Trojan

Posted: October 26, 2012
Threat Metric
Threat Level: 9/10
Infected PCs 176

Gozi Trojan Description

The Gozi Trojan is a spyware program that's designed to steal confidential information such as browser-based information related to bank accounts and other types of info that are profitable for criminals. Using the same Man-in-the-middle-based attack philosophy as the infamous Trojan Zeus, the Gozi Trojan is capable of altering the contents of web pages so that victims will give up information without realizing that they're no longer interacting with the bank's own website. These attacks even can include confirmation of suspicious transactions, allowing Gozi Trojan to take over and empty a bank account without many symptoms for the victim to detect. SpywareRemove.com malware researchers consider Gozi Trojan a high-level threat that should be blocked and, if necessary, deleted by the best anti-malware programs that are available.

Gozi Trojan: the Spyware that Aims to Overtake a Greek God

The Gozi Trojan is designed to use similar attacks to Zeus, which was noted for its prolific distribution, sophistication of attack methodology and overall invasive nature. Like Zeus, Gozi Trojans operate by enabling fraudulent transactions through normal website interfaces that are used by banking sites; similar 'transactional' types of Trojans include Carberp and SpyEye. Already, SpywareRemove.com malware researchers have gathered evidence that several dozen US-based banks have been targeted by Gozi Trojan-related attacks.

The Gozi Trojan uses malicious DLL files and Registry changes as part of its installation process and, like Zeus, doesn't display a separate memory process even when Gozi Trojan is open. The meat of Gozi Trojan's attacks uses HTML injection techniques to alter the contents of web pages. This can be used to 'phish' for additional information from victims, but is especially dangerous because it allows the Gozi Trojan to initiate and confirm financial transactions on bank websites. As spyware, Gozi Trojan also monitors and steals both dynamic and static information, such as passwords, security question answers and login names.

Although your web browser may use slightly more RAM than normal, Gozi Trojan doesn't show major symptoms of any of these attacks that could be detected by eye. Encryption defenses also prevent outdated and simplistic anti-malware products from detecting the Gozi Trojan accurately.

Shutting the Gozi Trojan Down Before It Filches Your Life Savings

While the Gozi Trojan has acquired attention from the press due to its man-in-the-browser style HTML injector attacks, SpywareRemove.com malware research team also is forced to note that Gozi Trojan may be utilized for other attacks. As a Trojan that makes contact with a C&C server, Gozi Trojan can be configured to install other PC threats or compromise your computer's safety in additional ways. At this time, infection vectors for Gozi Trojan have, unfortunately, not been defined thoroughly.

Advanced anti-malware software should be used if detecting a Gozi Trojan infection or deleting a Gozi Trojan is necessary. The Gozi Trojan has a track record of evading detection, as well as confusing anti-malware products into believing that it's a different form of malware. You should be certain that all anti-malware products that you use have the latest updates and are capable of defeating high-level threats like Gozi Trojan.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Gozi Trojan may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



8e8f1f48abfab5b34de3da348e783aa6 File name: 8e8f1f48abfab5b34de3da348e783aa6
Size: 52.22 KB (52224 bytes)
MD5: 8e8f1f48abfab5b34de3da348e783aa6
Detection count: 16
Group: Malware file
Last Updated: February 20, 2013
163e46fbb3e13199b67c13fdecd934bb File name: 163e46fbb3e13199b67c13fdecd934bb
Size: 62.46 KB (62464 bytes)
MD5: 163e46fbb3e13199b67c13fdecd934bb
Detection count: 15
Group: Malware file
Last Updated: February 20, 2013
4905cedbfaa8feb50a48b82af14a65e5 File name: 4905cedbfaa8feb50a48b82af14a65e5
Size: 556.98 KB (556988 bytes)
MD5: 4905cedbfaa8feb50a48b82af14a65e5
Detection count: 12
Group: Malware file
Last Updated: February 20, 2013

Registry Modifications


The following newly produced Registry Values are:

Regexp file mask%APPDATA%\tasklogon.exe%APPDATA%\tasklogons.exe

Related Posts

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.