Extracted

• • Target

    28fbd3fc99308421a8af62da8b3dda15_JaffaCakes118

  • Size

    385KB

  • MD5

    28fbd3fc99308421a8af62da8b3dda15

  • SHA1

    4ad2ee7a1d57ccbf234776f4de1e0794333ae87e

  • SHA256

    9a83965820f95e2ef43f07816d1dc949a00f44743a3d221a45533588090853e9

  • SHA512

    c01f6cbcf527e212d07a9f732914f8822ef82bfe8feaa1dff8054062b665f1475600f88a3e071160662307f468cfc06b21d0800d4ac4e7c732f0097ac1eb9011

  • SSDEEP

    6144:N8wU0T8AVLbWkgZyTSFWnGC463wBNfEbEBJry11XANEygLCjeZuLupwVroY0E0Oi:608AVLb0ESFWnGC2sEBaOT6un5oE0pp

  Score

  10^/10

  gozibankerdiscoveryisfbtrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    3e6bf00b3ac976122f982ae2aadb1c51

  • SHA1

    caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

  • SHA256

    4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

  • SHA512

    1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

  • SSDEEP

    192:eP24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlbSl:T8QIl975eXqlWBrz7YLOlb

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    lioncels.dll

  • Size

    83KB

  • MD5

    877928bb6863631a29aa72bfb42f45c3

  • SHA1

    836842655340ebac488f43a6408211dd36422e69

  • SHA256

    31a45c9a62b9c2392ab7b5bbdfae800c3d5433e5301683188100a7ca3b1ed864

  • SHA512

    efa0b7220285b5c22fc6afb6f6c00da897a5647cdb38023bbf6e0d51868746e39354944457c7ef6dbda01a4e3a5fef53659e4f746c88ef2887f9c94168955d85

  • SSDEEP

    1536:4wNc2GM5ItYPDim+eGNC1O/CukSN1SyrJL/vpwwgK+u:4wFENmROqjfyrJLSF

  Score

  3^/10

  discovery
  behavioral5behavioral6