Extracted

• • Target

    JaffaCakes118_6f2ed1b899c1fc62c0e081a8d24fc455

  • Size

    49KB

  • MD5

    6f2ed1b899c1fc62c0e081a8d24fc455

  • SHA1

    14a939196a91f40156b58f19d90a94ca37186b33

  • SHA256

    a7f413018c2a419f2c035493f53145bf0da2c0e3cb91dbd03bc561df4e97eee6

  • SHA512

    3152acd97167a050531c8fd8598fef1e1daaf0585867e8c48a0ffde2a3022d4e0239dae62c22be164722555554ad6f28bf3b957bbb7d547e16b3788134c18401

  • SSDEEP

    1536:yxQ0jkanEqtQDV2NZpVSGozp2zZ2Z1yi:qtgA7uVuHup2zZC1y

  Score

  10^/10

  gozibankerdiscoveryisfbpersistencetrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2