Extracted

• • Target

    c50010e1b6c2e7c851a080420de36b70_NEIKI

  • Size

    163KB

  • MD5

    c50010e1b6c2e7c851a080420de36b70

  • SHA1

    daadd80326296f46d308424618a75620a3ea2668

  • SHA256

    403966dbd0b5c9c64f2cfbd8cd4e511251cc3911538a773c9ae01a3c71e04260

  • SHA512

    89b012197a7ac09555d81fd0e3d04d9a0f65bccae1b617e35ccedfa8ef6b5e83798cf07f63db5b80a7c99c220c55fe325aea9024d6ad4a719af29640b2c10c28

  • SSDEEP

    3072:LjDvhYM4NjZpwZ7K1OWVrFVZmWXwltOrWKDBr+yJb:L6MgwZ7K1OWrFZXwLOf

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2