Extracted

• • Target

    fd0630924ef15e07741aefabf665ca30_NEIKI

  • Size

    163KB

  • MD5

    fd0630924ef15e07741aefabf665ca30

  • SHA1

    99c303eed4696ace8103bda0864920af4855b1c1

  • SHA256

    dd87aee6384ccbf1776bef905b0d55cbe7502ebcb405425b10a3af7ddf48c596

  • SHA512

    387e3cb4d58adc550a53f29aa910bd4fc359f144ee0d90226f7733126c172521790705728448b4981e6da72a54adddcffd457ccdac4c0bca92a2a9f1b705dc36

  • SSDEEP

    1536:PBk+17OQNHFi3jwNasdfpRJZ8B793plProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:O+1hli3jw0sdpRAfZltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2