Extracted

• • Target

    d40a5c7080b1d3b49cffa699f5e0d50f_JaffaCakes118

  • Size

    2.9MB

  • MD5

    d40a5c7080b1d3b49cffa699f5e0d50f

  • SHA1

    e90e3cd8c3f146e8b0c804590e7d5580095aa2c2

  • SHA256

    82f072d94b93f32e58e905da05f215baa8e4758f57ad30d2f08482063f9ed799

  • SHA512

    fca98b9c340515f79f9d0e9ba5b51c2fe88769d5f679b57eb7cfb7fb3056f0bc8f2d7538e67e2e549094622d104b5f6cff0e31236c5039fd6231c1dee361445a

  • SSDEEP

    49152:Uv6DBWGkJ2iX1wQhAfV6+2D0mhD9r6J8vM0aKMBwP4M338dB2IBlGuuDVUsdxxjl:Uv6WpvhCfPGpUJHBwgg3gnl/IVUs1jek

  Score

  10^/10

  discoveryupxgozibankerisfbtrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2