Extracted

• • Target

    a0447ed2548c9c9e3a1dd3c54b371bd0_NeikiAnalytics

  • Size

    163KB

  • MD5

    a0447ed2548c9c9e3a1dd3c54b371bd0

  • SHA1

    4d80f54e456e4eddf82de00f204530dbf9baba9d

  • SHA256

    ca0aebf2b52facc3aa7cb1867e1a6b0e5592aada56084e29752fedff811d52d8

  • SHA512

    0adfd7e5c72ac46c37950908fd7544922ce581aa40158ac8421558b70d8fd59f392d624b9e446aa2d9232a03df76dd373ddab82edb12e5d9a85ec860f93ec1eb

  • SSDEEP

    1536:P2TGrUPe3Yx56ctXFHcIctIcFMjJZio5wlProNVU4qNVUrk/9QbfBr+7GwKrPAsf:uoO58RbFMjJl5wltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2