Extracted

• • Target

    c6d49f449b9ada17ff8b41351f3abd2b_JaffaCakes118

  • Size

    2.9MB

  • MD5

    c6d49f449b9ada17ff8b41351f3abd2b

  • SHA1

    40d18cab809c17449bfc1e844923017043fdfc2e

  • SHA256

    823b67d0e311b371e11ca00a5e9cf35dfb92a81694890055ccb16cf1b1be9b73

  • SHA512

    0e007bb996c660ed17979e64d7c7577b4b63f2c82965d50d610ff840971336677788fb7732e4cd3ef40999383f1906b9980d0064fc7720c76644c9d4434f0d88

  • SSDEEP

    49152:m7ixkP+EeK1cV0uVZok3OcORLHWEGM59Baj8BBT4SfcsUjoh48TyMPkXdwkyZ:m7EEeK1Vookk2EGgHau42c1joCjMPkNQ

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2