Extracted

• • Target

    b03b93bb049bf06c4f0ae5dc10ee1e90_NeikiAnalytics

  • Size

    163KB

  • MD5

    b03b93bb049bf06c4f0ae5dc10ee1e90

  • SHA1

    90b6535fa85f0aba1231dcd7fae0afe2719d1f00

  • SHA256

    1824b44843e2c2b75f47d56a02b1be4744912eb91def7574eddc0c47414af2a2

  • SHA512

    8e9a4dca1058539d2b4889d89342d67ff6f0dcfeada3c55a04c0214ebefafd39bfacbab27c2beeb74f7852ea37bc9db54fc25575c2e973cb42fdb3b34afa697f

  • SSDEEP

    3072:C/1+N5s9NThlVVEVVVVVVVVVVVVVVEVVVVVVVrVVVVV2xyltOrWKDBr+yJb:CrKyLOf

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2