Extracted

• • Target

    8d245426988d44f119dcbcc06786b1cf

  • Size

    2.4MB

  • MD5

    8d245426988d44f119dcbcc06786b1cf

  • SHA1

    af1f84314abd4f51b2772d52d9722dcd378dbbcf

  • SHA256

    a0534fdb6d88c10a42c37a0ea421fd97aa1afa9a364458baebc4380a35c10fa0

  • SHA512

    a7ad19785ad7288f3a0f02110d4773a2cc718faf0e753e9d246a6a5215a95e5c3a919d9c718d31a8ba37a985677cc99f835f6ff921d26a89e22d4ab2eeaaa92d

  • SSDEEP

    49152:nsYtTFW0GgJ5xsPXuoOYJitT/P4M338dB2IBlGuuDVUsdxxjr:CgWSY4tDgg3gnl/IVUs1jr

  Score

  10^/10

  gozibankerisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2