Extracted

• • Target

    edbbd3f3423ad55b5e96fe4f861d43bf_JaffaCakes118

  • Size

    5.8MB

  • MD5

    edbbd3f3423ad55b5e96fe4f861d43bf

  • SHA1

    7804b344e7d97ef21630d064c71e7ccf65dc71e2

  • SHA256

    42da53a3179dd9fff23e61441d150259731d568f3ff51da251660114723b34a2

  • SHA512

    ed8bf49e4c3116699351982b3ce17d7201596d1734505606179de24466f431e342ba256003a71bdbbfb3f1399f633840144e0f3137f08bbeca002164721672b1

  • SSDEEP

    98304:DCXTiWPQPlTonsHau42c1joCjMPkNwk6CdnnjhtY5bFgHau42c1joCjMPkNwk6:DmiiQPlFauq1jI8666bFyauq1jI86

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2