Extracted

• • Target

    20f5d3447421fd9a15e00046cf65706a23bf1641c70846addaab7aec70858161

  • Size

    86KB

  • MD5

    044b1f160597323983d2aea4c5084e96

  • SHA1

    e1604530e33a995271564d20e03c7eef87bbea32

  • SHA256

    20f5d3447421fd9a15e00046cf65706a23bf1641c70846addaab7aec70858161

  • SHA512

    e369f46faa06ba75e76f777a377ef1c928db9bc28c3dcea9a7f9139da76076ee95cc214de94557bafd7afcb2dab030d9d5736ebcb42b6d99dbd98deb34d60223

  • SSDEEP

    1536:zdF7M8AbadLJEkVvKmRZSMWq2yl0XEwCzJ0CmuJd4BXac6:v7MvtCRZXdtw6JBbd4In

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2