Extracted

• • Target

    f35c5278ddc2578dbceba85debe9bf6385d2168beafded39af3b607407675116

  • Size

    4.9MB

  • MD5

    449c6eee1dddcda6305acadf28646550

  • SHA1

    5d2d05b2f3c4a37d53bc26965ffb44b8df34e7af

  • SHA256

    f35c5278ddc2578dbceba85debe9bf6385d2168beafded39af3b607407675116

  • SHA512

    d4b02e5a020a66b5081400c8cabcab92dc6063e1b5f662d2afefe4df6dd70729eca2a132fbe6892dc216c36f36dd61b5849b041087fea331822003976b1d8a5c

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2