Extracted

• • Target

    f040a180f860356b97f0988fb5eae740_NEIKI

  • Size

    163KB

  • MD5

    f040a180f860356b97f0988fb5eae740

  • SHA1

    f377b5a28d2b52baadaba5a5fd542b2c10e603b9

  • SHA256

    276fa7e5b90ad3eca099f31f9c4c4b7338b1cc3390b1f1555ec8c874a12269a3

  • SHA512

    a0a4d6f87c20f274d3bf782fd32fbf7a8414e32332cb0aded9cf42fe6c9810b3e807b169fcf7ee70a17a217a54a88a416b704f7867f23bb70a37d201b1cf3b60

  • SSDEEP

    1536:PmYlKTOokgfaYlbiMZllProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:OuKTOoZaWiklltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2