Extracted

• • Target

    19cba654ad04c84f3fce752fb78f0680d857e3de3627b1c52d52bc1d8f55fd52

  • Size

    4.9MB

  • MD5

    c38d5f5b86c6546c386475236281a32f

  • SHA1

    d4ca641d0b06f1746f18f172696936ae20c4dc5c

  • SHA256

    19cba654ad04c84f3fce752fb78f0680d857e3de3627b1c52d52bc1d8f55fd52

  • SHA512

    f12b9e11c903cbea33cf7ca3e95f944eaefcad5d5d23f837e3841331b0a3975da14d0c243664b127c2e9fb2978ff6f1d6b103cb5f71970ddbc5e6862395a49c1

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2