Extracted

• • Target

    2a59d4ed30a0353f69cce57ad83831ea_JaffaCakes118

  • Size

    556KB

  • MD5

    2a59d4ed30a0353f69cce57ad83831ea

  • SHA1

    b2d39bf9a8cdc4d04d813693885b73d20d315b30

  • SHA256

    477d9deb21692b80a454f0a9794d0fafc13b5d5e60b271ef46787d9843f3f2df

  • SHA512

    df7ae3b549e78828ba75196ae4e981a5b3feaa2d46a0b6692f659d5345353f47571a6f67ce95065b288254ea04063732d3c6763185d02afa6cba5865876ec3d6

  • SSDEEP

    12288:tTiCMTiZkq8ul2j9rt5ELxL3Z4gO+GW67IAteL2SLudbHv4xMLtAYkDAC:FiNTkkqjl2j9rt5ELp3Z4NW67p3Z4xmC

  Score

  10^/10

  gozibankerbootkitdiscoveryisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Deletes itself

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2