Extracted

• • Target

    18e0e88d608cf4603349500ecdd59420_NeikiAnalytics

  • Size

    163KB

  • MD5

    18e0e88d608cf4603349500ecdd59420

  • SHA1

    fe775897b7f136a8d48309b1b55b3e6dc19adfc5

  • SHA256

    20444cfc1039b896e062e9b1397a882f4acd9e9d8c0887f335a5c4c4862ec595

  • SHA512

    3a645cefb778bb9c4d95f39d2bba34337f94621f7fdd405f24a3bccdc7418e32f820110789f565d8e198c31f9b45118feed4dda7a787f046f1d02b03d1b740bd

  • SSDEEP

    1536:PTnPVh24RSdMIMtlv1IhmkuYuviv3KSzVx5YBPnQwvYrclProNVU4qNVUrk/9QbH:bn8dkV+Fpv3hofQeYQltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2