Extracted

• • Target

    a5f1b10aa98ae47103c0c01e80c02980_NEIKI

  • Size

    163KB

  • MD5

    a5f1b10aa98ae47103c0c01e80c02980

  • SHA1

    4b1cf68fba82e760f97dbcf35a60127a1e55da85

  • SHA256

    5ea1d5787094fc4dd6990e223b0e909ec75c9fba03d546c95ec77efb8fb16f5e

  • SHA512

    3d9b1560189eb1390954071e51109934b5ffa453bea38b701c0b12b28e38d217dfeae33735af2ac55793374321377db79cbb65ae3c4a0a042af2a7078da6e1fe

  • SSDEEP

    3072:+DyM7G11qT07qAux2S1ltOrWKDBr+yJb:+Q1G07Zy1LOf

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2