Extracted

Extracted

Extracted

• • Target

    mkhg_client.bin

  • Size

    269KB

  • MD5

    499e31242369342df828f4ecccc873d1

  • SHA1

    39e6678ef0bbac8d618c3b6260748725d9a5fc58

  • SHA256

    3fc2e94fb5b59fb46127817e330f35339b95c9523743fb9d3c8eb5134ab61a82

  • SHA512

    38a38b8d696c9e0cad975b4605523116144bb1c87f0e2a2f069052cc1560801b44079850c5ecd8fdb77f9d4827d0542b3211d8341e43791f224d9bca775b62bb

  • SSDEEP

    3072:Ma55+80YB0HwMPvXh+jlYkHBnPtJfDp5MC+Hb9TWa:LszQMB+jKkhnlJf839TW

  Score

  10^/10

  gozi5050bankerisfbtrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2