Extracted

• • Target

    b51dfa17f2fee7930f4d86f884f542c0_NeikiAnalytics

  • Size

    163KB

  • MD5

    b51dfa17f2fee7930f4d86f884f542c0

  • SHA1

    e192779675bbc56e56ea3facdf9dd223af7cc778

  • SHA256

    bbf46772692f1a907c8faeaf864a169fdf71a8a06ef50bdd1211485db8642002

  • SHA512

    eb1e85669eef6e78ec228f4d3a5db26dcd79edeb31d93bc02a139f4e2a85a99d2e5ce99341fea21aa0aaa86fa9f68fb24da210b5fb91852e7ed09b8566830cbd

  • SSDEEP

    1536:PC/QIWiqfNwz1pm3CDlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:q4JiqfqzPmSDltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2