Extracted

• • Target

    cd46199b4207d5b74af1113af0d8137f_JaffaCakes118

  • Size

    2.9MB

  • MD5

    cd46199b4207d5b74af1113af0d8137f

  • SHA1

    ba360315b70d581659341bbe04ca6c68c7b781a3

  • SHA256

    fcd17aca9b9012d7dfa244459f648c1c2abb804af855bb9f7227598f6992b4ae

  • SHA512

    1fed841b01bd04a8620faa351e2772a0fca84e55bb9529c7fcc1415f188ddeeec65d14fe1d8e2ed189f0e1bb09c8699af6fcebf41c113cf1af6c37e539314819

  • SSDEEP

    49152:6ueHHM0xU2dACqa+Ny4EcEy/bXisjP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:6ueHnICqty4OSbXXgg3gnl/IVUs1jePs

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2