Extracted

• • Target

    a72fb77b5ebdc97fde709312a839a1d8f3b4595972cfe2f3a6df50d4febb1e4e

  • Size

    975KB

  • MD5

    6201ced0ffa3bed2d3db302fcfabfc30

  • SHA1

    d51cf8e108b4b63940ef8b6ce7c6dbda76338477

  • SHA256

    a72fb77b5ebdc97fde709312a839a1d8f3b4595972cfe2f3a6df50d4febb1e4e

  • SHA512

    1bb962bfb454268c3f6bffcd37607b49aba75c8566a9220aa2aad6d91e987cc782992d2640369481baa02051cbca5f846dba609e4d7dfddc2b5559c66ba560ef

  • SSDEEP

    24576:csxWEGvLvxGW9Y5C4cpx2yuVC+u5C4cpx2yuVC+M:cAOYYKCosCo0

  Score

  10^/10

  gozi_ifsbsalitybackdoorbankerevasiontrojanupx

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2