Extracted

• • Target

    af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics

  • Size

    163KB

  • MD5

    af70779eb3763a618b7c0d4bf830eb30

  • SHA1

    d87281eb6225cfa895ae5008513ee04bf7a8afde

  • SHA256

    68a929b7fc19a4f9dd4a4a88efb201539403ccd6657e193092087291076e8820

  • SHA512

    c34ddb0eec333a8b1f87ff5597cd4fa824f329a945111ae3e9c4811688501d689b3cb78148251f80942313d5f798246092543a050a7c8b6f97083129f0a4e91e

  • SSDEEP

    1536:PsVrSu7YCAMfM2ZE5W1mE680lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:9YM2ZE5xj80ltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2