Extracted

• • Target

    e9c7551c7cfb0ee395eedc3429524b5d3c890a396eae23880df4e974ebb76fe6

  • Size

    4.9MB

  • MD5

    444c09aba5706c5103b4ed10693c848e

  • SHA1

    e0fe61927573b49ffd9af58364c9d25250e0092b

  • SHA256

    e9c7551c7cfb0ee395eedc3429524b5d3c890a396eae23880df4e974ebb76fe6

  • SHA512

    ba02eecf7bde58f90476eadbf76ed2d1999b4b190b1bca6e4b81754798fb51ec0a5a2c87941c3749f42b42787ae9cf38a83539bb88cf003911461c379669cf31

  • SSDEEP

    98304:Db7A9aMnac9OyZ8DpCQdGWR+O/4vAXjU2lSBjlYh2grFZyNgnRC2b/BzM0DjGrCH:TRyEbgpR9ySBjGBkiR/P6O8neO3o

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2