Extracted

• • Target

    05abbc1fa84f0d6c0c0e8c55b3d2f580_NeikiAnalytics

  • Size

    163KB

  • MD5

    05abbc1fa84f0d6c0c0e8c55b3d2f580

  • SHA1

    9c65a037f4f0c900d013b9506e02815a52c2ef41

  • SHA256

    c615eb04a82fcec832966ef2b262593d01e1a1519b027dc2bd80751bf0c5f0d5

  • SHA512

    2ad690b2028794d0186621eb078eb8fb97ed73034d139d73ccc6944a33d047c20dbf93c789b6385ff7cf6febe837ba95553372a4ebb7fc8db76d51e07e6c3bb8

  • SSDEEP

    3072:U8YmWDBA0qaEztHhecIoZltOrWKDBr+yJb:U8YmWoXecIoZLOf

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2