Extracted

• • Target

    e5b1ffd2ecd7e610d07d093d65639da9_JaffaCakes118

  • Size

    498KB

  • MD5

    e5b1ffd2ecd7e610d07d093d65639da9

  • SHA1

    0ed01c2424e6fbfa6650d1c4ffd22b68bb19f9a5

  • SHA256

    066bf4cca227eae7a9e46e65fa518c08673ae7cc19e9563d36a7e4a1325f14af

  • SHA512

    930d36dcfc41415ee872d2f9ef20f7643e93b2dcda5a60b146184df7c7eb548c121fa2b60c0dd9df36a0701c2ee28cbc64725723c288e47ab27f0a3c3a871424

  • SSDEEP

    6144:MmoZkbtQmb25Zh18hqJbDqSB7Lvq2XsjYiVmOf7Yp4jOa9Upx:MmoZkmmCVRtPvq2+d/

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2