Extracted

• • Target

    16fd257c466f33fd2cc581d43f737150_NeikiAnalytics

  • Size

    163KB

  • MD5

    16fd257c466f33fd2cc581d43f737150

  • SHA1

    7226dddc31dfe384bfdfffa3c4a21db607c7075e

  • SHA256

    e0aedc4a59ee79f7c84a4b2168ce04f3d7eb94f4ed1f0cf2ddaf6d794a0634e3

  • SHA512

    11213173f997a1027bad637ac32879b0efc13ab971ff19b630c8d38258d1082cd7e27a0f126b8ff3178226c65407e811b95d63e87850edab3d3b8ff08539583b

  • SSDEEP

    3072:mtstRldFJQrUtnA5OPbWQs08lHQZd9ltOrWKDBr+yJb:m2RCubWQsRlHQd9LOf

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2