Extracted

Extracted

• • Target

    7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118

  • Size

    412KB

  • MD5

    7d62e1b94f471c3d0dc01af8ef1070f2

  • SHA1

    e49e8ba2aa87edf578ce603fc186b89e5f8ddfc3

  • SHA256

    2140eb8fb75c67eb1a7ab305c07dd6bb1bc97fafda4b6632e5e7a58bb077f497

  • SHA512

    8e953a842749bfebd81bb0785b733d5b3330fa4b265eecf0f01422d2d661ce6b7808f617aae5dcc908f3853bc5b74baa86537f7d5860f331f3a4e9bbef0ac59b

  • SSDEEP

    6144:2rKd/9yO8EJKdRWWyU/PgJoK01tDWUej3dc9YJTVK1GHzbAW0tOpOZibXPU/gC9Z:zdl7iutsClIqSYhjKT7x/++U0Zdd

  Score

  10^/10

  gozibankerdiscoveryisfbspywarestealertrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2