Extracted

• • Target

    49f7582f9949732932ef70599f777040_NeikiAnalytics

  • Size

    163KB

  • MD5

    49f7582f9949732932ef70599f777040

  • SHA1

    a3a2d8ffd5d99d7512001b4340a304d08e10dce3

  • SHA256

    bf221580aef5d0d76ef75b81da6925f98175534ca97c86165035e479013bf4f6

  • SHA512

    2662e3c75a792202b19eeb11106c5ecc0836c70b40865a9c8392628f20ff91a2379b9cd321f086c9a748093b9fdf1bef43b4733ba264ed9f46903f626db62ab9

  • SSDEEP

    1536:PvcQJZXCBgh7dOP8QsKos+r6EeG7W0jlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:xXzh8EQos+uEj6OltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2