Extracted

• • Target

    NEAS.9e04d4244ee5480425a35cca1a3d80b0.exe

  • Size

    76KB

  • MD5

    9e04d4244ee5480425a35cca1a3d80b0

  • SHA1

    6a6d828f735d34fc25cdffe22d8d49ebfc0499ce

  • SHA256

    abce3f75cb3aa4b1f8029c8ead8c61b40bb76a016814c406bda1699cfe5256cc

  • SHA512

    2e6c96e3dc30d9ca9b02c2b5a0dd3fbbc640acbbb79fbd18116b1624a34aba91b932d448e4661a4b4ce7e4a13845bddb848d29d974365bf3f9714b6c5bd1b0c2

  • SSDEEP

    1536:MvP69lUyW1UwzJmWRaD1gXI7uMrpzrnacxfzZ1:G69lU2UmWVXI7uMlzTFz7

  Score

  10^/10

  gozibankerisfbpersistencetrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2