Extracted

• • Target

    280806a55888f70ec1b5518fcf2062e0_NeikiAnalytics

  • Size

    163KB

  • MD5

    280806a55888f70ec1b5518fcf2062e0

  • SHA1

    991be0c99bb64554b7caad377cb3ab18de0c86dc

  • SHA256

    85b3471bddb501955ff5521e87d1a5089496b454bf06c17f7b92d3d424a88892

  • SHA512

    93fbbc91f449012bbcc910c01b7e0492b1f627efab474df4f1fa99ef56128e294ae5363cc79b7697b4c0fa4b46cbfc88b8448b1161215143a503634862ac90ed

  • SSDEEP

    1536:PvSIemapC0wJlvJtT7hnRKLgRClProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:NFaw0wTTVRK8IltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2