Extracted

• • Target

    94d74eea1b973535d17e6155a2badf81fe10452f9d7f1467897ae1105e4abf8d

  • Size

    4.9MB

  • MD5

    ee3b1a0e01b9b99b489083a3ec5bbfd8

  • SHA1

    2c9af168f2dc4489ea2b56b3d3dafd8629259487

  • SHA256

    94d74eea1b973535d17e6155a2badf81fe10452f9d7f1467897ae1105e4abf8d

  • SHA512

    51602af88ea63a2501c4bb5da2eb945ade0c53fa3b7415c98c525020e8af66700620f6ff90c6c4e0ecd299b2012c9f4a68f28cff5ce7d0683dd0a3c0d97083dd

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2