unpacked_gozi_sample.exe
Classification: Malicious
unpacked_gozi_sample.exe is a trojan (application/x-dosexec). Detected by 60 antivirus engines. Linked to Ursnif malware.
Detection summary
- 60 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: URSNIF (S0386)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Gozi | MalwareBazaar Abuse.ch | 2023-03-21 11:04:39 | 2023-03-21 11:04:39 | malicious-activity | S0386 Ursnif |
Sample information
- Filenames
- unpacked_gozi_sample.exe
- File type
- application/x-dosexec
- MD5
5e3679f687797e3bdf5534b64a5219ad- SHA-1
e2b6875ed9b55f75db73dfb0cc55477ab9bd0345- SHA-256
646ab5eb6224824f04f4b78b80f47e2b7251c8ad9af55d806f7a016403f2fa45- First indexed
- 2023-03-21 12:18:50
- Last updated
- 2026-10-08 18:12:32
Antivirus detections
| Engine | Detection |
|---|---|
| MicroWorld-eScan | Generic.Ursnif.1.F166E860 |
| ClamAV | Win.Malware.Ursnif-9975502-0 |
| FireEye | Generic.mg.5e3679f687797e3b |
| McAfee | GenericRXMQ-TZ!5E3679F68779 |
| Malwarebytes | Malware.AI.4022682327 |
| Sangfor | Trojan.Win32.Save.a |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cyren | W32/Injector.AUG.gen!Eldorado |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | a variant of Win32/Spy.Ursnif_AGen.D |
| APEX | Malicious |
| Cynet | Malicious (score: 100) |
| BitDefender | Generic.Ursnif.1.F166E860 |
| Avast | Win32:BotX-gen [Trj] |
| Rising | Spyware.Ursnif!8.1DEF (TFE:3:azZNVjbz2IN) |
| Sophos | Mal/Ursnif-F |
| DrWeb | Trojan.Gozi.916 |
| VIPRE | Generic.Ursnif.1.F166E860 |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.qh |
| Emsisoft | Generic.Ursnif.1.F166E860 (B) |
| Ikarus | Trojan-Spy.Agent |
| GData | Generic.Ursnif.1.F166E860 |
| Jiangmin | Trojan.Generic.hpvbw |
| Avira | HEUR/AGEN.1245293 |
| Arcabit | Generic.Ursnif.1.F166E860 |
| Microsoft | Trojan:Win32/Wacatac.B!ml |
| Detected | |
| AhnLab-V3 | Malware/Win32.Generic.C4338348 |
| BitDefenderTheta | Gen:NN.ZedlaF.36344.du4@aaFyNPh |
| ALYac | Generic.Ursnif.1.F166E860 |
| MAX | malware (ai score=83) |
| Cylance | unsafe |
| Tencent | Win32.Trojan.Agen.Qgil |
| MaxSecure | Trojan.Malware.300983.susgen |
| AVG | Win32:BotX-gen [Trj] |
| Alibaba | TrojanSpy:Win32/Ursnif_AGen.77d74b8b |
| Antiy-AVL | Trojan[Spy]/Win32.Ursnif |
| BitDefenderTheta | Gen:NN.ZedlaF.36802.du4@aaFyNPh |
| Bkav | W32.AIDetectMalware |
| DeepInstinct | MALICIOUS |
| Fortinet | W32/Ursnif_AGen.D!tr |
| K7AntiVirus | Riskware ( 0040eff71 ) |
| K7GW | Riskware ( 0040eff71 ) |
| Kaspersky | VHO:Trojan.Win32.Convagent.gen |
| Kingsoft | Win32.Troj.Undef.a |
| Lionic | Trojan.Win32.Ursnif.4!c |
| MaxSecure | Trojan.Malware.203598581.susgen |
| McAfee | Trojan-FUXI!5E3679F68779 |
| Microsoft | Trojan:Win32/Gozi.ME!MTB |
| Panda | Trj/Chgt.AD |
| Rising | Trojan.Injector!1.EBC2 (CLASSIC) |
| SentinelOne | Static AI - Suspicious PE |
| Skyhigh | BehavesLike.Win32.Generic.qh |
| VBA32 | TrojanBanker.Gozi |
| Varist | W32/Injector.AUG.gen!Eldorado |
| VirIT | Trojan.Win32.Genus.DPT |
| Webroot | W32.Trojan.Gen |
| Xcitium | Malware@#xctvcc1dn08u |
| Zillya | Trojan.UrsnifAGen.Win32.19 |