Extracted

• • Target

    35f5d615b3ac58cc88ee89ea0a146cd0_NeikiAnalytics

  • Size

    163KB

  • MD5

    35f5d615b3ac58cc88ee89ea0a146cd0

  • SHA1

    7505881161ef68c83c60b767f748cce42f49f98b

  • SHA256

    9aea1f43a50c433d2a0cce469e63fd57dfbc11f6baac2edcdc586a57e5221e90

  • SHA512

    a590bc20cba90aa6d30eeee951c53ebb380df2468e3f85e2c7786207ea002c5324cd87f0c68d2ba5dc3ba9964ec41e6608b55f148947a48292571f64d463d45f

  • SSDEEP

    1536:PCdUiIgZGAPszkKyFEFzMWxGtlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:qdUiXZGgpWxGtltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2