Extracted

• • Target

    8c49f09bf36be366f86c0cf7d8ddde89_JaffaCakes118

  • Size

    1.3MB

  • MD5

    8c49f09bf36be366f86c0cf7d8ddde89

  • SHA1

    912fbf8fff22760e87b3fea91774db7eae8d464d

  • SHA256

    75d062d4e8e1d9a4acd6efa3e6bdff7d35cb340fbdc73a69e0a82b847bf9cc12

  • SHA512

    3b1c0d3b1cfd56ea906253afbc9a136d5a57e121c3ed9c931654e727f90ac2b52f44e75b93aec14546eaf5a49fcfb2e12d191adab25a2674a8c56d23f09eb32b

  • SSDEEP

    24576:99mESdENDoUW52v5KwPozwhs/3xBoMZjA4h/WLL+FvG:KTyk152RKt8s/PoMZjfh/WL

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2