Extracted

• • Target

    acd6a07d3b7f8e626dceec3310ced6a0_NEIKI

  • Size

    163KB

  • MD5

    acd6a07d3b7f8e626dceec3310ced6a0

  • SHA1

    6b09ade249af5f91f8996edfbc8faeba334aff69

  • SHA256

    3012a4d3845685de52107521ce0cdf965d96adf3a10470a75abd48b455763a1b

  • SHA512

    d3d5275e32b92b7ddaa44fb5daf11f502b1c2ab701bb4546577a33b3b1626acf657e2ff60efd7c6ad2b0652ab3ef9f57e0a1a4340d9b6abe12c59020b0044904

  • SSDEEP

    1536:Pnm6WQsQpR8AkQVAAJTFWbVj1QOXoibI1h6z2lProNVU4qNVUrk/9QbfBr+7GwKn:u6WQHHmXoXsiltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2