Extracted

• • Target

    0fdf27b4717437b9aec153f8a70a20e0_NeikiAnalytics

  • Size

    163KB

  • MD5

    0fdf27b4717437b9aec153f8a70a20e0

  • SHA1

    079f558cc34c6d07e68f541f90d3b80d808cf5cd

  • SHA256

    79eb3638318065cf718ca2a7acdef0fee1222d21fc78576a1b2429774f9363de

  • SHA512

    b37460d18906b39fc3adc7e008a7473a04b1e32674201116c7bd6c07dead6e643b9de25a21d525b26bc2bc966add4ded9c4d22fda08da5fd731f6aa360b9615d

  • SSDEEP

    1536:PyekDh/KPRNPseNoBurzoPKpDlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:WDh/MRds30rAaDltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2