Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e3fyc1Yqrm.exe

windows7-x64

10

e3fyc1Yqrm.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3fyc1Yqrm.exe

  • Size

    14.8MB

  • Sample

    240913-tmhxqsxbpd

  • MD5

    b7eb4e534c7d36dee723a23f7e59c330

  • SHA1

    6566cdb7eb847ca3a8c4d9a5f2731bca60fcf86b

  • SHA256

    eaf59a5f7ee285a410f2cfbbf75befa377e195eee7a931b5da28ed01689598ab

  • SHA512

    016dabb5ed9597d83868f6e34f419a041d534bccca64d4a157c457c892dc87d28499bc97449fdda3cd256f9afee071e0cd3e2529ab89541a91c4aeb90f9eb1e9

  • SSDEEP

    393216:RCzOIKxEfqPNsBcka0VdhVhMKC0MJBdJzoCQs/MG8:ROKuTpVdhVhM7ndRooMG8

Score
10/10
gozibankerisfbtrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      e3fyc1Yqrm.exe

    • Size

      14.8MB

    • MD5

      b7eb4e534c7d36dee723a23f7e59c330

    • SHA1

      6566cdb7eb847ca3a8c4d9a5f2731bca60fcf86b

    • SHA256

      eaf59a5f7ee285a410f2cfbbf75befa377e195eee7a931b5da28ed01689598ab

    • SHA512

      016dabb5ed9597d83868f6e34f419a041d534bccca64d4a157c457c892dc87d28499bc97449fdda3cd256f9afee071e0cd3e2529ab89541a91c4aeb90f9eb1e9

    • SSDEEP

      393216:RCzOIKxEfqPNsBcka0VdhVhMKC0MJBdJzoCQs/MG8:ROKuTpVdhVhM7ndRooMG8

    Score
    10/10
    gozibankerisfbtrojan

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks