Extracted

• • Target

    115a3bd7014a6d70a51019f4bd569100_NeikiAnalytics

  • Size

    163KB

  • MD5

    115a3bd7014a6d70a51019f4bd569100

  • SHA1

    5cfb1cfb1440994ec023f0ef8fdce89dfe7981c4

  • SHA256

    9b3425df61be39de7abb5fed7e4808ace733549a25d7d1b59ec1c8162da5309d

  • SHA512

    5e4ba5e33f2a2ea8a77cc933bf712319ec388baed80db7867cbed499cbbf1c6cb88229d07e0bfe9aae770ed12ac557bea9df2296c6bedde7a67c1040a78464e2

  • SSDEEP

    1536:P46egiFKZRYoGCWPW3hEaFHYW2lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:0tFYRnGCh5YW2ltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2