Extracted

Extracted

• • Target

    89.exe

  • Size

    37KB

  • MD5

    6fd188840e7d734b23a5b22ae7eb0e6d

  • SHA1

    d156adc662164a272c8a70ac013cae8b9dfdf6fb

  • SHA256

    893ba03135a5e8e53d4413ae269f85cab2dd56b451bd99cc233064df402d3f84

  • SHA512

    c63eb0695e5dc2dc8b643a8c7cbd4c499be9ad6236d8792f5ec1ac4ad6bc22b82e8aa01f6a859240151e8534f920cf71e45123a424ee1efa8178cc813464b2c1

  • SSDEEP

    768:SsdUYVI40pItPyDOXXQepWOr60DiREQwFepXBkiKbXuDtcSqDZKkCIof:jFVI4ttPbmOr5iREh8jpDuAFIof

  Score

  10^/10

  gozi_ifsb1200bankertrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2