Extracted

• • Target

    dde81f2fe88c01d2a0a68529b7a70a40_NEIKI

  • Size

    163KB

  • MD5

    dde81f2fe88c01d2a0a68529b7a70a40

  • SHA1

    b5d05e00351ba662c21563e06c4df1cafd3a3037

  • SHA256

    ec53d264ff3697c5e5d19ef902f6ef7f24bfc80678b3612ff7c1081fcb735a20

  • SHA512

    1ac02251fa1f124aa25e175300faa4bfa00c925b369f256218bf376acd04e7183b18af2b158d58f2548ac6a78c94c8f44deb1e60e6a7cce381e234da805ff178

  • SSDEEP

    1536:PZi67/OCjhD+VNrbbZ8/YFb8t0lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:h9NjkrfrFQt0ltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2