Extracted

• • Target

    478b4e98f7e62b3864522ebbeb098a00_NeikiAnalytics

  • Size

    163KB

  • MD5

    478b4e98f7e62b3864522ebbeb098a00

  • SHA1

    bceca91830deb7976e85772844b58c1f42e62dec

  • SHA256

    756b02b71881ecac8a3d4da099479a23869974882d20df6a450eab398bda5c94

  • SHA512

    46ddeb6806209bda85f7fe031b1f46e8db40efde10acfbda429d22933321b3425558274b717f8136fcc722b0dacf54471abf770676fd59a04db97084e5ae9ca9

  • SSDEEP

    3072:DbKUbKyz8YsgaIKE5Kw1fSOltOrWKDBr+yJb:DeUbcRlE5Kw1fSOLOf

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2