Extracted

• • Target

    e514b4ab5503165b0bcb9733ccbc3450_NEIKI

  • Size

    163KB

  • MD5

    e514b4ab5503165b0bcb9733ccbc3450

  • SHA1

    d63f5c3f953c6e10da2ed6be2252fa297e1d13d9

  • SHA256

    15fbe38974dc0b5dd0db1be3cf33bcf1f207f3722401d160652e3461db4e2034

  • SHA512

    87dfd5040afa6a54eb9cfbfca61c93e1f8319cadf8fe495df7b00852f0a8c35dc83dc1a7376e8275359a31e72e1315abaf2674fdfc60843f6439e6eb01d616a0

  • SSDEEP

    1536:P5s2UymmkhSe91RRlFluxNj4jHtTgralProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:xsXyoF9dluxZ4jHlcaltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2