Extracted

• • Target

    79d5adce123b5ac2b43fa6f85cab19f7_JaffaCakes118

  • Size

    113KB

  • MD5

    79d5adce123b5ac2b43fa6f85cab19f7

  • SHA1

    b655c1fd76c7e44c5fbf6a12d13f54b4209c626c

  • SHA256

    2cb4c475804369cbb5b4200540038d393c3e21e42d56ea472d75e38a663271c8

  • SHA512

    8ca88e2ad5537654b20e39a760661d73735d24e7263754f8bcc268d278c4e7790c21c31aeeb28f3860ada70ee4547cfa90989300fd8c7ac8fbcffc07f69c504b

  • SSDEEP

    3072:+hzx6tb4TRlr6tne5UXnVUiMRvitdZ9w9XI:+hV9WeaavadZCX

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2