Extracted

• • Target

    08411dc581db97808136e5ca7690cfd0_NeikiAnalytics

  • Size

    163KB

  • MD5

    08411dc581db97808136e5ca7690cfd0

  • SHA1

    6ecb0a1a1cf59fd00a7a6373784d183281ff50a0

  • SHA256

    86f9bebcff206f4ec578e5884151bc028a79cc1f8d0505ffd8d52c1766d63e66

  • SHA512

    a56854aff2c47ced4833156f97ce5127499126b8a8617835d2b699d002ba2fb4cf75a52d52816cc90977e34f550b4617ee47faeb5ce11b821ff92ac763c2d80b

  • SSDEEP

    1536:PJni4IiJuvSLRtQ+Y91LMlvwwwwwwwQ2G8TlProNVU4qNVUrk/9QbfBr+7GwKrPb:84IiLhwwwwwwwQLultOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2