Extracted

• • Target

    2edb9333b749e26d78cf8e0d01875540N.exe

  • Size

    7.6MB

  • MD5

    2edb9333b749e26d78cf8e0d01875540

  • SHA1

    c735a73c8185466e184c0a05470f46fe7c4c198f

  • SHA256

    25c910b9ddf17baf841ed4f7baa4d7296d3a6411e901e567b0bd7f6454ac2440

  • SHA512

    5dbfc9bc1080c497816280ed45b618f819f7abddd03656b8dcc4a1833b4f01414c3ab734679a89501d4614d546e771a948c935b59c538eb403a22eeb717a280b

  • SSDEEP

    196608:fDXNRtASz9zqwWfKEvxvbbVCKlfMFELMc1GpC5o:fDXlASz9zqntZv3PMCLMc1Gs5

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2