Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

8f8291153e...38.exe

windows7-x64

10

8f8291153e...38.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f8291153e28508f9c8f0c8c6a03f0d3a261a5ab950ad5904629c28b49692938

  • Size

    4.9MB

  • Sample

    240911-qc5f7sscrf

  • MD5

    fc61ebb70c39c1edb88514ff988019a9

  • SHA1

    16814858d6d34374605c4f8823b5780b41abaf0a

  • SHA256

    8f8291153e28508f9c8f0c8c6a03f0d3a261a5ab950ad5904629c28b49692938

  • SHA512

    987b74101ebb5f014f4c08ef116d0284fb6824619b45df24affd19508b67264e98ea934e7b202f3bafc882e32184097cc8e566385ff81e7cd0a80e559a3887f2

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

Score
10/10
gozibankerdiscoveryisfbtrojanupx

Malware Config

Extracted

Family

gozi

Targets

    • Target

      8f8291153e28508f9c8f0c8c6a03f0d3a261a5ab950ad5904629c28b49692938

    • Size

      4.9MB

    • MD5

      fc61ebb70c39c1edb88514ff988019a9

    • SHA1

      16814858d6d34374605c4f8823b5780b41abaf0a

    • SHA256

      8f8291153e28508f9c8f0c8c6a03f0d3a261a5ab950ad5904629c28b49692938

    • SHA512

      987b74101ebb5f014f4c08ef116d0284fb6824619b45df24affd19508b67264e98ea934e7b202f3bafc882e32184097cc8e566385ff81e7cd0a80e559a3887f2

    • SSDEEP

      98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

    Score
    10/10
    gozibankerdiscoveryisfbtrojanupx

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks