Extracted

• • Target

    afb4846bd287f31e6297cb4095aece65_JaffaCakes118

  • Size

    511KB

  • MD5

    afb4846bd287f31e6297cb4095aece65

  • SHA1

    b92d682a800d82ff6e980deae88f6cb7e048c11d

  • SHA256

    639a86559b0a086fe388e4309ea22e49f79362c0983df1a5b09fa477db3c463d

  • SHA512

    8f5b3062a7f4faada34001bbe8510235d20b3d507ee0858ef23db92853f31a3075c60e37738a93e1385995199c9d99dccb7e547247fc9af5b8a8f3557d03d070

  • SSDEEP

    12288:nTY7/WAuLAOOxsgfj40bDKg0m7t4is8jYar:kusO+RDKgJBnsgYa

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2