Extracted

• • Target

    704deae7dbf2756d3345e0b06c22c460_NeikiAnalytics

  • Size

    163KB

  • MD5

    704deae7dbf2756d3345e0b06c22c460

  • SHA1

    bb27f131b1ab2f63a2530819414a920118d54528

  • SHA256

    285c6c51ecddd1e4930d294e5c68cb730619051a9cffb36ab2b098be83bad3c5

  • SHA512

    7fcd4cc1a608881b9d4f89c8425d4350284862552dcce04fde58f59adf5aca182a33deaab735adb58225ab3476719ab749ab9e6182516585ad0a42162e1ba763

  • SSDEEP

    1536:Px9zbwEBJdJ0sZzuiiECjeoGn6l6QlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:J9/xJdJ06qiiEOeQPltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2