Extracted

• • Target

    dd093f1f60c7c41bc1269520d573978b_JaffaCakes118

  • Size

    9KB

  • MD5

    dd093f1f60c7c41bc1269520d573978b

  • SHA1

    77875d454160d210d3141e42ea0451a977b2de34

  • SHA256

    176d02977470034934512a168c058e3cfd7c5bbe972a81de7e6344ef8793f2b0

  • SHA512

    f7db86fe31dad316c9a7cacd62c27612524fcdecda4b7552fcd373a722de81a5042d19e422b7cb5d3908278cf154dcde147cf5ef31a04bf4cfd6e7e4b4f80c94

  • SSDEEP

    192:hZKB1E1MUtqavIdGkrDV++YQ9FaNJhLkwcud2DH9VwGfct8WF/3I:ho1E1MUtqHdzDwQLaNJawcudoD7U/F/Y

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2