Extracted

Extracted

Extracted

• • Target

    client.exe

  • Size

    294KB

  • MD5

    e8076ccdf5fa25a9b54bf28c85775e2f

  • SHA1

    787750437cc8b121f798863f55060e2fe362fa01

  • SHA256

    94f9901021891b76a7602ad7a8ca17ba0b8b2fb268c3d2417a7fdc226519ac33

  • SHA512

    44fa12fd3dc538c7ac5bc5fe1da0e2a04afe2586e2b7977cf8d845a91e32d0173ecb145a972f718b6d3439350d7630d04cb342a3c388bd2f2a8ebe07a6e5e93f

  • SSDEEP

    3072:n2S7BTivBoduzHLmtkY2j0eUnkrfPqU6xyhACMOTMNjAY:2WB+vaduzHLmtMSnkrXq7qAgQN

  Score

  10^/10

  gozi5050bankerisfbtrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2