Extracted

• • Target

    ebddc22a802c325109c25fe426ed56d0_NEIKI

  • Size

    163KB

  • MD5

    ebddc22a802c325109c25fe426ed56d0

  • SHA1

    3ff2c4b500d210ca48ca5ee059e0aa6364eaa704

  • SHA256

    fd5fc3156b47c1dadc7e8a6a941004978dcafaf82563d917ef4f0ad2114fbd3a

  • SHA512

    b751dc1c09d32783533142a64e18fa4259ecd97bbb2e2be521334465b993638e9bd7d0c3296a500ca2fc093193e8d3bbacc3b2cf7d9ce732c7e0f8db203e2670

  • SSDEEP

    1536:PEXqhjiGQ86jM8fppRFFPETIHXJtHlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:qwjiztpXFCTIHXJhltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2