Extracted

• • Target

    be6daa9bc47555213dc261b364118e90_NEIKI

  • Size

    163KB

  • MD5

    be6daa9bc47555213dc261b364118e90

  • SHA1

    171f8d19b703d07121f830153a5b95b0040bb6a1

  • SHA256

    a397c4879d40acfbf70dec516d57860c2d12608ad64427996fa7a16bb6c41534

  • SHA512

    f4e64e936dc2aa3ac72e655d95ea35803b275daa623a9480fd3ff65e7fdb06b14dda7e7e91e260d258c8c6b629161974e1b893f3d6e829b877bdee84af812d03

  • SSDEEP

    1536:Pg3MwGGu3Y/rCHUR2/ObWlU8m9dlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:pwGfY/rQUR1bWSl9dltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2