Extracted

• • Target

    0c12ab163eec92789482489f8b512170_NeikiAnalytics

  • Size

    163KB

  • MD5

    0c12ab163eec92789482489f8b512170

  • SHA1

    4934c2411f80c1ee9359d7fe45f9551c5c4d9e7d

  • SHA256

    d917c36bcc0981763ad50609c8807ea790ea290c361710eb5218621fa8c7efcf

  • SHA512

    f075730b98244a18ccb8eca742058714b4d2b5a2b6ae5c9cf4eb6256adcdab6f2f146e4689f1dc2b9fb2fc5acfe301edfcc69edc30898a48649c75e95066dffd

  • SSDEEP

    1536:Pb6IT2w9Z+aisPV/PRoqrFXa9deaAJf5RlProNVU4qNVUrk/9QbfBr+7GwKrPAsf:eIqYhtXR3FOeNxRltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2