Extracted

• • Target

    2b99f5abeb2dd426085be3aeddd16d96_JaffaCakes118

  • Size

    1.3MB

  • MD5

    2b99f5abeb2dd426085be3aeddd16d96

  • SHA1

    44a60dc6e7f016552427e43f6c4e7390e6504f31

  • SHA256

    93a86f29e85507cd4c2a021f3a6b0bccf40bf3519feb5d9fab38dcd97dc63a1b

  • SHA512

    7489a72f89054455a830f5a752bbc41e66c42190acd6c07638ca6ea6f7efd8824a5c2ad2e32e966ce462f9f2a2085839f5bef92dee8e3a8b2e289eaccb8fd434

  • SSDEEP

    24576:fGPpbvJpARCuKTK0tGR+/sKGpt5ozMyKCxRdFKJ1O0lEbtGZI7nlkL27ikXHvG:fYIELe0g+0KGvizMy3dVcEk+naa71X

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2