Extracted

Extracted

• • Target
    proxychain.bin
  • Size 255KB
  • SHA256 104e6094ef239aae7e4317433e868b67108b8157627dc222f996cb087795334f
  • MD5 fe45c50d912ba5114f7cec59f5ce3a1d
  • SHA1 40706642be37ee48ce49faa4592a6e977aa5c3ca
  • SHA512 7803bc3ae1a8deb1c04e27d7a7d5c623c6b667a71ec5e9564aefa2d5d8cdc40c2a5129844b5fc5ca20a8074719601b2ebf6cc0b66c460c4570a42314f4110409
  • MD5 SHA1 SHA512

  Score

  10^/10

  gozi_ifsb202201bankertrojansuricata

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2