Extracted

• • Target

    5901cb6fe9b8fbcdb05db73a303a77f1d9e739fc77daacc9f0f691b601d43809

  • Size

    4.9MB

  • MD5

    722b51e5af295e7f74e893a933b63f78

  • SHA1

    a027412040b5c59cbdff59c1ca220224b3e65942

  • SHA256

    5901cb6fe9b8fbcdb05db73a303a77f1d9e739fc77daacc9f0f691b601d43809

  • SHA512

    3079b4b4c55c5739ff2537b350060422a5580fc65fd3534162cab0dcad79b0e143fcc0b62f0d11112fed6bb0e0838b9f9dca990efaa750e1b7ee614d5f102760

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2