Extracted

Extracted

• • Target
    2026-08-23_9c1a775c509d2eab4c74aea4522e688d_elex_wannacry
  • Size 716KB
  • SHA256 27b309814aa3e368763930951acd41082630543340c5fd7374257719995476bc
  • MD5 9c1a775c509d2eab4c74aea4522e688d
  • SHA1 3b52b1fa804d36482eefadde9f2a9e4900bc61c1
  • SHA512 3ecef163387232ccd10404eb823492b1800919b47e2f9d8ee83762908d362760449755594747118201d41c0afbc174e0a6a8ba64985b8cf9116367e40f1e1496
  • SSDEEP 12288:cAtySH7FNN2VL6SBP/4FXCm9QgkWDoZ11Q2dht/gW5BVM820rFL:cAvFStBwXChqI5LtF5B3nr5
  • TLSH
    T13DF4C0D3D3FC22A1C7A08FB3FBAA587C1708C8F660E982265DE3E458499944D67564F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker1099discoveryexecutiongoziisfbpersistencetrojan

  • Family: Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2