Extracted

Extracted

• • Target

    f440fa474cd9b56eabcaec533575534c_JaffaCakes118

  • Size

    784KB

  • MD5

    f440fa474cd9b56eabcaec533575534c

  • SHA1

    e2b186cc7a5aabb2e6f57cc4ce870d051c68c2ff

  • SHA256

    ffab60c984ea7cb26874a93eda9fa5d9af376465e5a5b54770a511b377e55cb9

  • SHA512

    949ba35475709f5ca2fa2b4cb2e3df43e62ed16c3641949f5092fdf3c24b754d619dfd864bc2f2555e1c19069aba18ebb0e05d6b6a6af1c217c2e10f472655e0

  • SSDEEP

    12288:oDYGqPDIHSAUoE6G5l0ogbUaUQiydcgoG4YLlcHYK3L9jIq:Y/qrIHuP1l8UQiWcSlctFF

  Score

  10^/10

  gozi1000bankerdiscoveryisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2