Extracted

• • Target

    86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8

  • Size

    4.9MB

  • MD5

    32015ffa59e656dea9ca43bc953655f5

  • SHA1

    dc2d352d93c7d5baf01caa82be5ab07f0a472dc2

  • SHA256

    86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8

  • SHA512

    502eca2738943139cb57e884b862aadd052940fe4900ffd46f60f735273bb02a74d51b33dbc6e2a89765be3b4234f47f3056fddb13651f27f7ec77ec943148be

  • SSDEEP

    98304:6ikaW9Vf1T25iCHZWqqVN9iUf4B7iHw3EItOOaQ1+5PxPU:/8hC53q79iz779U5+

  Score

  10^/10

  blackmoongozibankerdiscoveryisfbpersistenceprivilege_escalationtrojanupx

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon

  • Detect Blackmoon payload

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2