Extracted

• • Target

    96a4e6b80d8038ca18d0d8946ef25caf3b6c904d25690e1a0e4a55700a4f2a5b

  • Size

    4.9MB

  • MD5

    654606fae6339ed5d474f880f41a2c2c

  • SHA1

    e179ec0000e142843e81e282d1ff46ca12ccc143

  • SHA256

    96a4e6b80d8038ca18d0d8946ef25caf3b6c904d25690e1a0e4a55700a4f2a5b

  • SHA512

    328774a065e309e3ffdf8aca73211285915b70a3828e5cd6fea7c5bd268a2fa176f39d642a5d31b82ffb6e5ca4b0b9599bf146783daf510c0e4abe34145b0448

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2