Extracted

• • Target

    bd64a9e40e82030c300468f36305b190fdb1fb026166770ab1b881cfa55416ea

  • Size

    4.9MB

  • MD5

    109f0c7a05efcc1ad2d31abe5a3bbd41

  • SHA1

    4023ba0110e0f82d2eead46e941cef41ada8e9d4

  • SHA256

    bd64a9e40e82030c300468f36305b190fdb1fb026166770ab1b881cfa55416ea

  • SHA512

    001210849d1969ebe22122b8dbfd92346d1df2c143d06caa5aea1f30733396ae5533baf6051c07ea492bbde2c68125239fcac66ff43511c3ad53d04ec91e02f0

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2