Extracted

• • Target

    698b9a1d1eebcd8ca309239bc99353d0_NeikiAnalytics

  • Size

    163KB

  • MD5

    698b9a1d1eebcd8ca309239bc99353d0

  • SHA1

    392bdb75ee130f65fbec240627e5ee305d2a1488

  • SHA256

    759a412d5d889b6a12cc2bcd4c7e969426fc4272e26a5e64d51eacd0b8d848bc

  • SHA512

    728a29fade7548ebc287b6b14aed5f37845f89cc51954fe96ab2b37b81fb3597fe9a20a5a88b53c01f82ae2356618b0e6e892ab2771dc685c6c78e85af739f13

  • SSDEEP

    1536:P75dZACtB8qJXBXkPvIEVXjz7BLCNFElProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:TLJXWvIEVn7BeNFEltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2