Extracted

• • Target

    b1262ca2812e10dc82b2fe917609ae9f65f6574f8437afebf747be9ad8966860

  • Size

    4.9MB

  • MD5

    39752bf9f691996ae0e12dcf88fad5a8

  • SHA1

    452602ccda8d546e89f89207711f949f1e831cda

  • SHA256

    b1262ca2812e10dc82b2fe917609ae9f65f6574f8437afebf747be9ad8966860

  • SHA512

    88aa9c3cb69ccb21f46c84281adbda7fb1ad8b045589befaebee2f1087d56f77b526fdc299cd18a0ee3de8944c4df6fe5d293c1f41fa195ddc1c4c0b5f96be12

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2