Extracted

Extracted

Extracted

• • Target

    NEAS.NEASNEAS858d867cc62c0bf13b16ccdb9f6cd6022d61fc2ab98a7db60806a35c7da9b2e0dllexeexe_JC.exe

  • Size

    206KB

  • MD5

    72e2a5c797954e895a41be5b20f867b2

  • SHA1

    419aacfb3ccea9b08277bcc9405054fa4238a597

  • SHA256

    858d867cc62c0bf13b16ccdb9f6cd6022d61fc2ab98a7db60806a35c7da9b2e0

  • SHA512

    77be53cf579f69ee728fafbe93568b8d4c462490ba3fe053db367798508abb0d7a838731d17e465f0a29b982eb49e1227d94c971823e1d375b2b761887e107b3

  • SSDEEP

    6144:sMmIE7vr+qWNGzfXDanCU60rPP+vJsWKq12Jy:o/7DrQGzfXDeCU6cevKWXwy

  Score

  10^/10

  gozi5050bankerisfbtrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2