Extracted

• • Target

    b79c277ef25496a714a669b48f5700b0_NEIKI

  • Size

    163KB

  • MD5

    b79c277ef25496a714a669b48f5700b0

  • SHA1

    41fce4d4036179aeb3a069dac2e65852b4b0f277

  • SHA256

    c04ed1654ce41002b7fcaa93ac9036e8b388f4887ae3a9aeffadb66aca889fae

  • SHA512

    c860d5405e91a7750baf03f312c42a57c44b38881ff18baa6814bb395e97355f7233cb64679e056fd3ac051737e63a0ca01a3670af572331d101d9cbc6805134

  • SSDEEP

    1536:P74qprbj7VhY9duqbpF8YxJYQpHO/hMUIlProNVU4qNVUrk/9QbfBr+7GwKrPAsf:DLo9d5dnxJ/peaUIltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2