Extracted

• • Target

    f014a2f9c2c33ba4573d5db80446dd40_JaffaCakes118

  • Size

    2.4MB

  • MD5

    f014a2f9c2c33ba4573d5db80446dd40

  • SHA1

    0ebcc9b92d368bcaf0da8cfd1e53d5e3a98a00c7

  • SHA256

    0c25e453116b5347b677bd151e6cc1832680ea855437d0e5c9be50d17db34a2a

  • SHA512

    8177f0b5815324e5cdeebae6b993fd2c2c027c7d8902afb0e9d24df797138e96e72dacb651a9de8831f0647f3e5fadb1dbd3edc1802d748ddc1648fa05a18f9d

  • SSDEEP

    49152:HF3VjI3SOU9GPDYyibTkgWJ6AM1pGRkP4M338dB2IBlGuuDVUsdxxjr:HF3jxGPJivkgaUp/gg3gnl/IVUs1jr

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2