Extracted

• • Target

    b0d08e4ee2a958c8e69e78c0ed6fe068_JaffaCakes118

  • Size

    187KB

  • MD5

    b0d08e4ee2a958c8e69e78c0ed6fe068

  • SHA1

    aaa6bd7d04e5de7f3c21f90de1f0a8de22ab6446

  • SHA256

    624fa3daa42ba4f5e7302c2ce0909f76eb68e9c9717690698b0d902ebbd7a2ab

  • SHA512

    f4f1b43c606fa2b862364da57a25a11f3efa808d7838e6fe23fdb50c8e2c71ff7d193f75aca194eaff696fcc6ceae7e2798f561b74936681c83b9ae08670dc5c

  • SSDEEP

    3072:UR8Lk17GNK1hnz3lOOEZtcO5tonqoe7p52wGi00I112oqkPmvFSZBibTGHI:Uv1SNKnnzylXsSdxGLt12KkFSZBUTGHI

  Score

  10^/10

  gh0stratgozibankerdiscoveryisfbpersistencerattrojan

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Server Software Component: Terminal Services DLL

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2