Extracted

• • Target

    de701736d0b00d6727ea5d1f300b7820_NEIKI

  • Size

    163KB

  • MD5

    de701736d0b00d6727ea5d1f300b7820

  • SHA1

    5cc4ca33ed36a04b705a97f8e19bb41024600a92

  • SHA256

    783dc29221c2aa74abf8c7a6c329d2030022339d69d3c46604bd5ea8243dda0e

  • SHA512

    1752cdb4ec2247efb0c4ffcdd7ceb4b2f480d153468b71c96b00beca9c36dbad12b078c688c3087cc15cc98b04246d8a3364de90a48a126ab4c06e1cffe6cc13

  • SSDEEP

    1536:P0XRGfSgFvaDCmDtImgg+lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:sBGjmB+ltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2