Extracted

Extracted

Extracted

• • Target

    Documenti.url

  • Size

    195B

  • MD5

    4d7d46f082ea539ffef896638e7f621e

  • SHA1

    f1b9e5c62fe28ba60f7977bc9ff7a48124d40294

  • SHA256

    2d58ddd8ca73f4eff0945a3537e0a7bf888fdf7fb963ef43d8e07f5517404f69

  • SHA512

    9f14c82416a0861348cec391c9f87664bd0772a5bfd973c3ad0ab6bb071df5778781d2ba5dbcedfbc65d26c58c86eb9d14a8299cecd611e9dfedabbbf1fa922e

  Score

  10^/10

  gozi5050bankerisfbtrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2