Extracted

• • Target

    d918916cfe13004ad87a53216838c150_NeikiAnalytics

  • Size

    163KB

  • MD5

    d918916cfe13004ad87a53216838c150

  • SHA1

    3672561ee91d67cc5c6a613273bc0b47c8027a73

  • SHA256

    327e08ae77dbaed99429c7f094e1153e3931e47e06c6be9421688445ddd90acf

  • SHA512

    74cb82c51a07014f87cc5b23231e8a97756268ac812a0b4f642ad3ee85f698ec4b667a5f1ede490b41287806e881969abff4be5d353499c790c6aeb8b0a362c9

  • SSDEEP

    1536:PuOhBx5leX7SpCbd4+mOYRNyiF7V/4lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:HhBblE7okmZb4ltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2