Extracted

• • Target

    3c1235ca242b24627c32f1d64e6cfc55_JaffaCakes118

  • Size

    5.8MB

  • MD5

    3c1235ca242b24627c32f1d64e6cfc55

  • SHA1

    0b22c2e30103fbc59f9b7d8e6324ab7407e45071

  • SHA256

    a75d3f02edb6764c31c033339c94322d5c8af0dd0473d4682abf99cc832dd715

  • SHA512

    3a5653cc134092c3c991ff3e1890aa549fc0a8bf1d0a8a191db82aa9e7aac209a9df6b69694b83eacbe0feb547865c364d37f1d6fe4360a022630d9acdc5df59

  • SSDEEP

    98304:bSx1V8gzYDHQ0/1O8eQe0yvUwgg3gnl/IVUs1jePsULAEVr6slCeZ8isagg3gnli:beMH11OuJUgl/iBiPqEVWhegOgl/iBiP

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2