Extracted

• • Target

    3f707897d1d7d509755f5c5f15b482e0_NeikiAnalytics

  • Size

    163KB

  • MD5

    3f707897d1d7d509755f5c5f15b482e0

  • SHA1

    f2d435bf8220689f61721693a8916bfd476496d9

  • SHA256

    efeecad655ebfb9093247d6047b4cff7649f57ef0780080f6c2cbf30348a7b8c

  • SHA512

    39918b1db6ae8fc027267f4703727638a8abfda489f84e85543b8d965ff22126e3890bc0db50b1420338689cb6c1c71832f908857f4a7f707ffd2dc659ba048c

  • SSDEEP

    1536:PJ4a/uTP5k+GXwZX6bvVHsp2SL/wQEflProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:mDu+G6cvVHsp2SrEfltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2