Extracted

• • Target

    72d87d1b2fd174b3d335bd34ac1653f0_NeikiAnalytics

  • Size

    163KB

  • MD5

    72d87d1b2fd174b3d335bd34ac1653f0

  • SHA1

    57300ef24e056c4ce21fcbdc6b48f64bca477e1f

  • SHA256

    aeb274e1e0770384250576ccd9cdf17a912e0f4723ce9bca5c727f9ef20f86ee

  • SHA512

    b1389c644a0cc4a1416c46b4d4d1d3b1c0d04ed7e8a7be6b0766fa1475428460450cc5d35c1f95b88f7bbeac4eef8af72d4a22e36192ce6edab3f9f25f391364

  • SSDEEP

    1536:PSwAia+1mR4GwSH67YRv6hlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:aX+1mRVc7YRChltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2