Extracted

• • Target

    2fb63a9843cc17deb8deb636dd9c123840644b0776ddde10c7297e9b0d58d6d9

  • Size

    4.9MB

  • MD5

    bb4ee1a273cdb74c13dd571e6e66c59b

  • SHA1

    3aec293cacdddf0c00394e884c3237e2d11330df

  • SHA256

    2fb63a9843cc17deb8deb636dd9c123840644b0776ddde10c7297e9b0d58d6d9

  • SHA512

    b68add9a84792c7f7bed427b9b19b9a22507621fe015f27abaa132dbc474e0c5a61f83b43572ace5c4872dca4854f164c7fb1ed401cad4542820b8e939af6838

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2