Extracted

• • Target

    44a59c16ddb3d9b88826d38a702c1530_NeikiAnalytics

  • Size

    163KB

  • MD5

    44a59c16ddb3d9b88826d38a702c1530

  • SHA1

    bf2d6d083907e1b91e7546a4e527f885ee50a177

  • SHA256

    218d306ea4d6f1a1964a153e7c64a01f65895fd8e8faa9132f2593b2569f4c21

  • SHA512

    12a5e91a0e66b8bf394a05d61a1ecf238ffdc3ff4607aa541b085ead984757152c3e67768112ff7288f4f377083198a406ce394c5743faef935c033b7e171b1f

  • SSDEEP

    1536:PX8+zvpPPnEl8NcpY2/cd99LsFlv4lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:U+V/EONv2/cBsFp4ltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2