Extracted

Extracted

Extracted

• • Target

    client.exe

  • Size

    295KB

  • MD5

    de21fe50192a021dd37b67881fd332ba

  • SHA1

    44c9c72bf5cd81a82ce7870dc765095f303c7fdf

  • SHA256

    729398faa8543e0a21d46b6881a4111d9c36c05e05f6efe669286f668ac97cab

  • SHA512

    6650fe6e0f2866e442a9f753f90fc8aaf594d1d976207a94724f506d840ad6514b4c18392cbc3d51304dd2afb7fadce72f71b385899136b2e593c9fc1eda934a

  • SSDEEP

    3072:F62X2mvtkAa8QoRzUA/nAUZSuJC/w3mA8FfbJ1fzodp/jhNGY:s2XXviAa8QontJF3b8NHfzodpv

  Score

  10^/10

  gozi5050bankerisfbtrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2