Gozi Trojan

Posted: October 26, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	176

First Seen:	October 26, 2012
Last Seen:	October 1, 2019
OS(es) Affected:	Windows

The Gozi Trojan is a spyware program that's designed to steal confidential information such as browser-based information related to bank accounts and other types of info that are profitable for criminals. Using the same Man-in-the-middle-based attack philosophy as the infamous Trojan Zeus, the Gozi Trojan is capable of altering the contents of web pages so that victims will give up information without realizing that they're no longer interacting with the bank's own website. These attacks even can include confirmation of suspicious transactions, allowing Gozi Trojan to take over and empty a bank account without many symptoms for the victim to detect. SpywareRemove.com malware researchers consider Gozi Trojan a high-level threat that should be blocked and, if necessary, deleted by the best anti-malware programs that are available.

Gozi Trojan: the Spyware that Aims to Overtake a Greek God

The Gozi Trojan is designed to use similar attacks to Zeus, which was noted for its prolific distribution, sophistication of attack methodology and overall invasive nature. Like Zeus, Gozi Trojans operate by enabling fraudulent transactions through normal website interfaces that are used by banking sites; similar 'transactional' types of Trojans include Carberp and SpyEye. Already, SpywareRemove.com malware researchers have gathered evidence that several dozen US-based banks have been targeted by Gozi Trojan-related attacks.

The Gozi Trojan uses malicious DLL files and Registry changes as part of its installation process and, like Zeus, doesn't display a separate memory process even when Gozi Trojan is open. The meat of Gozi Trojan's attacks uses HTML injection techniques to alter the contents of web pages. This can be used to 'phish' for additional information from victims, but is especially dangerous because it allows the Gozi Trojan to initiate and confirm financial transactions on bank websites. As spyware, Gozi Trojan also monitors and steals both dynamic and static information, such as passwords, security question answers and login names.

Although your web browser may use slightly more RAM than normal, Gozi Trojan doesn't show major symptoms of any of these attacks that could be detected by eye. Encryption defenses also prevent outdated and simplistic anti-malware products from detecting the Gozi Trojan accurately.

Shutting the Gozi Trojan Down Before It Filches Your Life Savings

While the Gozi Trojan has acquired attention from the press due to its man-in-the-browser style HTML injector attacks, SpywareRemove.com malware research team also is forced to note that Gozi Trojan may be utilized for other attacks. As a Trojan that makes contact with a C&C server, Gozi Trojan can be configured to install other PC threats or compromise your computer's safety in additional ways. At this time, infection vectors for Gozi Trojan have, unfortunately, not been defined thoroughly.

Advanced anti-malware software should be used if detecting a Gozi Trojan infection or deleting a Gozi Trojan is necessary. The Gozi Trojan has a track record of evading detection, as well as confusing anti-malware products into believing that it's a different form of malware. You should be certain that all anti-malware products that you use have the latest updates and are capable of defeating high-level threats like Gozi Trojan.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

8e8f1f48abfab5b34de3da348e783aa6

File name: 8e8f1f48abfab5b34de3da348e783aa6
Size: 52.22 KB (52224 bytes)
MD5: 8e8f1f48abfab5b34de3da348e783aa6
Detection count: 16
Group: Malware file
Last Updated: February 20, 2013

163e46fbb3e13199b67c13fdecd934bb

File name: 163e46fbb3e13199b67c13fdecd934bb
Size: 62.46 KB (62464 bytes)
MD5: 163e46fbb3e13199b67c13fdecd934bb
Detection count: 15
Group: Malware file
Last Updated: February 20, 2013

4905cedbfaa8feb50a48b82af14a65e5

File name: 4905cedbfaa8feb50a48b82af14a65e5
Size: 556.98 KB (556988 bytes)
MD5: 4905cedbfaa8feb50a48b82af14a65e5
Detection count: 12
Group: Malware file
Last Updated: February 20, 2013

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%APPDATA%\tasklogon.exe%APPDATA%\tasklogons.exe

New Gozi Banking-Theft Malware Variation Bundles Destructive MBR Rootkit Functions