Extracted

Extracted

• • Target

    72d70e94e54ba232ba3f798699669990_JaffaCakes118

  • Size

    446KB

  • MD5

    72d70e94e54ba232ba3f798699669990

  • SHA1

    16f257adf89a56a93a6be45bf470a71d4d570d26

  • SHA256

    93b1135cdbed6e1bf1269248d28e5a5f74fb5cb234c6385b56d025839bada289

  • SHA512

    e024605c3469c27d470dc2cdb17bdef55507c80feb81969531277f96083d96511ab4e14d16f61f1723e0a97a69f6c201cfb34ac3584da8ba415e5f05582a139d

  • SSDEEP

    12288:rFQyFgwMQsXS3NG5ddoM4YQYgDhgvMph5O0ZcQ:rSyFgTQ9NydHQ3evs15

  Score

  10^/10

  gozi3000bankerdiscoveryevasionisfbpersistenceransomwaretrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Windows security bypass

    evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2