Extracted

• • Target

    NEAS.e825deab7b4fe321aac8c0537e31460d.exe

  • Size

    163KB

  • MD5

    e825deab7b4fe321aac8c0537e31460d

  • SHA1

    997fd1456b3b8ada168eae4b3e357d08763a3435

  • SHA256

    873c09e43386d2a189bce2599b3ca29e59ad2ce88e5313e3c9ecc444b446fcaa

  • SHA512

    0d7bd7aab05c36353b22a42e35fd3f87ae271a3e71b96e2634de710b3e6e45032d05a3ece654187edc3800cbd86200c48b176e02c1dd8b463b9cdb55eebc2781

  • SSDEEP

    1536:PEVSSTWUkKcR9g+QRwAixTzgeRjlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:cvWW8gniPx1jltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2