Extracted

• • Target

    11be305e30458f2da3bbe7eb26cbf760_NeikiAnalytics

  • Size

    163KB

  • MD5

    11be305e30458f2da3bbe7eb26cbf760

  • SHA1

    abc6f0831e7b9f6522cda5eaaba04291ebba0284

  • SHA256

    ea9fdf4e83540263250ff1ce031315101b4c17abeab4141cfcdfb0c7ec3628db

  • SHA512

    b47186b260a3a8e1bd5376bbf9ec04f52ef978b890cc6eade60b1472b39008b6c2b2bc9db01d80663935a4c559a1b664dbf91a5f498cedcc7f0a08f24d46da23

  • SSDEEP

    1536:Pyq0//nElHh/LC6JRPZtD9c33LlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:KqS/nE7m6J3Y3LltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2