Extracted

• • Target

    f0f06610463a4e90b4c0f94a85dc49fe_JaffaCakes118

  • Size

    2.9MB

  • MD5

    f0f06610463a4e90b4c0f94a85dc49fe

  • SHA1

    c6a381b6b463d4c3856ed343841b122bfdef9163

  • SHA256

    bcece95a3d6858f4ce37e8f93c2138716df2b9f90e2027fe6f2bd6f85630316a

  • SHA512

    02ac7b47dd1fd40792a586f1de340666e721113ea64843823588b8e205df98073ff9647d8dd72834cd8ad72b0ac0c81dded35b4eb55bfab5afe2792653463312

  • SSDEEP

    49152:J1Pu1UXE+7vZPO4mH/zipEXGLZwuszq/UpHpfsP4M338dB2IBlGuuDVUsdxxjeQz:J1Rt3dgXUgg3gnl/IVUs1jePs

  Score

  10^/10

  discoveryupxgozibankerisfbtrojan

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2