Extracted

• • Target

    f1f0d87e42a1f9e57393b7f67b24999c1c4d6bbc76bd71f12dfbd01a37d5e401

  • Size

    4.9MB

  • MD5

    90e54c21061623f9cde4c10d4bc76c98

  • SHA1

    fcee24bf38bf4ec00c25a5b1c2b026d5a4e56967

  • SHA256

    f1f0d87e42a1f9e57393b7f67b24999c1c4d6bbc76bd71f12dfbd01a37d5e401

  • SHA512

    63bae1d21cacbf15acbaa4ccdd110f8f8b20e9c2b34d379ef1cbaa895863d594f9c32e520f5a9b4f7db54a32dc2ed056ba9f716040f5bed33d402a1d9d84bd36

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2