Extracted

Extracted

• • Target

    695579360bdbdab40a0df450af10628d_JaffaCakes118

  • Size

    474KB

  • MD5

    695579360bdbdab40a0df450af10628d

  • SHA1

    254c8f577b9f44727de32aa440328ef00955db59

  • SHA256

    29ac9f2b359f91e5403bd422e55fa24ce3f890adc58b59bee29d7b0e3a8259e6

  • SHA512

    9314b8dc206a798e05db9796e64da2ed177b8d23777ffb23ca7ebdec63f438a516be6b01c9e65b7c76355bc96e220124200d3e1400d34e4fc094314d50e098ed

  • SSDEEP

    6144:uB4cfIB+6+AVbYXkbv7xxfC0Gwxbr6hYYJg:uehB+YVbYUbjxx60b

  Score

  10^/10

  gozi1010bankerdiscoveryisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2