Extracted

• • Target

    NEAS.e2f12e041e256651e86fe4abf60f9340.exe

  • Size

    163KB

  • MD5

    e2f12e041e256651e86fe4abf60f9340

  • SHA1

    d4ffd6104d5f01c4639728b4e4b39b6e9d9ee7d2

  • SHA256

    dcf49504e6f155366ee4b2c4449290de85daa101abc33324a3a13eb44585a949

  • SHA512

    dd1a2bf79692f36e5bb7722b3e56bb04b22172626fbdc42ecb65bbc6c10437b35d8e9b74a38ebcb047ec65e2155aa17c11c84d7d024fb8868a09c52f28ea5d56

  • SSDEEP

    1536:PTtPaDDY2N/a7Ms42TW7Bx2BvlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:7MDDRdiMsRfvltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2