Extracted

• • Target

    db4e4015cdbd2d0d0f126d8164326e3c051cf9ad26ba8aac757c6c30204fba73

  • Size

    4.9MB

  • MD5

    db935d63349b924bc1e426c72da370e4

  • SHA1

    94605920b9c0ad8b4de49c7146cf117ba1d22953

  • SHA256

    db4e4015cdbd2d0d0f126d8164326e3c051cf9ad26ba8aac757c6c30204fba73

  • SHA512

    3689428ea27b9643e7645267ab45fab44cb083f9efd2962e39dcc215ecb114ee430e06e48916d91aa74968ae70cd68c35368e53592b8d8c1cdc6a7916e31816a

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2