Extracted

Extracted

• • Target

    64.exe

  • Size

    37KB

  • MD5

    a0e3596ac737f7ca98538a1479e4cdd1

  • SHA1

    b312eacda77ec55e6fb9fb62ab0b756ca50d8201

  • SHA256

    64a6b3f1924ebcd8d162482001721ee6459e23811055b6d9d79c8db2d7af327f

  • SHA512

    d67f340c9147f314e41e72c3a002ce6c22a538422f50f707b599b54458d7bf7db4824a748c249d8438e831a8b5bd0ca568cc2d23cedac32ad16f42c43b929d9a

  • SSDEEP

    768:V41V8UHIm2qyiBMoxKRZsLgY5AQnkcgIHAs5Tdh77k3mNrow5:VefIZqtBR6Zsd5U8f5xhfk3eo

  Score

  10^/10

  gozi_ifsb200000bankertrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2