Extracted

• • Target

    ac7d6be7d64731dfc67e3daefc94f339_JaffaCakes118

  • Size

    2.9MB

  • MD5

    ac7d6be7d64731dfc67e3daefc94f339

  • SHA1

    0fcecd2079c4559b80912690b738f80ccf6096dd

  • SHA256

    73c0f91991ecdedc05c667a4038464e969493e8d60c6d6bfd612aa15c67ff590

  • SHA512

    6b8082182aa14c681fe556cbe6e23fd002aa7d5f41a586e7ebcf7765ddf7bdb9272161618ba483a2e0b01765cb08489833a143157c0596203f2886b0460d97bf

  • SSDEEP

    49152:hkoiS4brLqKOjgXHe4rv4IZQP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:qKKJHe4Mgg3gnl/IVUs1jePs

  Score

  10^/10

  discoveryupxgozibankerisfbtrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2