Extracted

• • Target

    9ec24a27d113dba8c864075094f03340_NeikiAnalytics

  • Size

    163KB

  • MD5

    9ec24a27d113dba8c864075094f03340

  • SHA1

    d539043d873b41b3bc8780a5f3152b82c67c796d

  • SHA256

    f46c5b2a921e24e7288efc94968e2a75ddf664a9f8a62b491fe2fa94dac253f8

  • SHA512

    0da89fd0d84097e8a49723bfefd634238240fbeb783fce03ffc95b3476d7539b779e3077aa531fe75521570cbb89ace3401c84c4a26bcd1679ee4d1d01c53869

  • SSDEEP

    1536:PfWYzUFkfBJfc45tGqS3Leo4c3Nf1lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:oE1LDno42tltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2