Extracted

• • Target

    bf312f90c41c277c2fe0b65b13bf8c60_NeikiAnalytics

  • Size

    163KB

  • MD5

    bf312f90c41c277c2fe0b65b13bf8c60

  • SHA1

    961b7dc276db995372eb60f14ea00c8fc2a94768

  • SHA256

    5e2103c32a8171ffca328937a9b5bab4be5713d5bacee0dfead37fa946d515b5

  • SHA512

    9bf778947d144927d1b94f65ca7ceade8df543640d947a22a32a79b258ac947a1b0b57a91b3a89edf53f31e61e065c44ae648cefa9c5bb6bc3f6ab285e069272

  • SSDEEP

    1536:P6yUHemyCBrf0dd9hmEkPOSkxmIClProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:SyJCBwdHhMQTCltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2