Extracted

• • Target

    8fdae33001299bb6162d8362540d82c0_NeikiAnalytics

  • Size

    163KB

  • MD5

    8fdae33001299bb6162d8362540d82c0

  • SHA1

    a5b2dd55fa3fcf04ab49bf429cd4a8eca17be920

  • SHA256

    a2b88541258727d139ae7822f32647d3a4c8bda4ece08a741d6e2641350b4c44

  • SHA512

    aacf06e9fae3f38298dd1002d6d33292b3b9c73cc003ee81d4a1ce04b29e39daf9a0870cc4c128c4fab2f2d1a0e9029019bb227d79d73c24560dc560a0c6872d

  • SSDEEP

    1536:P8Y13fZWeraOwtwKYAzL1plProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:E03fBWp2KYg1pltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2