Extracted

• • Target

    4a26c4e512e4e856033189bc7997e3e0_NeikiAnalytics

  • Size

    163KB

  • MD5

    4a26c4e512e4e856033189bc7997e3e0

  • SHA1

    f73f239ba93bb9c729e2f13df6004348e1474b8a

  • SHA256

    38031e6a424a147adce31e0d88c53b3e142c066e08a13f83e357e3af004dca74

  • SHA512

    0ce9fb33b061b72e2be6b1e62dcde8aa38e274fc4383f862606b8ff2b2c252047edf6b96ce1f2d74942f2804aa42a490ea121282f464fb576b815e216b35d542

  • SSDEEP

    3072:gBV+BAv0iu3RqPWMDqfltOrWKDBr+yJb:geBiTNeMDqfLOf

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2