General

  • Target

    cffa1a365c88b4ec7748fe38d42f1fd0_NEIKI

  • Size

    163KB

  • Sample

    240508-e5a8aadd88

  • MD5

    cffa1a365c88b4ec7748fe38d42f1fd0

  • SHA1

    eceb5de4652111a8ae168c7eab02586edae6e17f

  • SHA256

    06c696f5f623a185107bc8ed0feaf9d4cb7c7083aa85f9962be131525fc4efe4

  • SHA512

    5e880fcb641a44dafe3b5cf3830a6e872654a0f4c5844ab19dc615905b4bddd64e4f694448a89e7aff330edc2e6bf37c9ad3cbbb2b16d686061e60d2a4a78b54

  • SSDEEP

    1536:Popr3BQ64+uIaN30KK56gOZGJsH1jJ69olProNVU4qNVUrk/9QbfBr+7GwKrPAsf:wprtjq0KK5ZOkJs76oltOrWKDBr+yJb

Malware Config

Extracted

Family

gozi

Targets

    • Target

      cffa1a365c88b4ec7748fe38d42f1fd0_NEIKI

    • Size

      163KB

    • MD5

      cffa1a365c88b4ec7748fe38d42f1fd0

    • SHA1

      eceb5de4652111a8ae168c7eab02586edae6e17f

    • SHA256

      06c696f5f623a185107bc8ed0feaf9d4cb7c7083aa85f9962be131525fc4efe4

    • SHA512

      5e880fcb641a44dafe3b5cf3830a6e872654a0f4c5844ab19dc615905b4bddd64e4f694448a89e7aff330edc2e6bf37c9ad3cbbb2b16d686061e60d2a4a78b54

    • SSDEEP

      1536:Popr3BQ64+uIaN30KK56gOZGJsH1jJ69olProNVU4qNVUrk/9QbfBr+7GwKrPAsf:wprtjq0KK5ZOkJs76oltOrWKDBr+yJb

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks