General

  • Target

    7679b8182e8ed9305e92eb6a9f11c080_NeikiAnalytics

  • Size

    163KB

  • Sample

    240515-ejch8age32

  • MD5

    7679b8182e8ed9305e92eb6a9f11c080

  • SHA1

    98bb8d333bcca8d66c1bed24a424ad76793c2683

  • SHA256

    4c482696a86601f00dcf573aa436cb85be21375a2e2e9255ef97ff167e3c529e

  • SHA512

    8818514b63f3c51f00ed4b822cfab7156357db8d87dee42b0656b9c66f1a208131a53b546027a8c49b67cdad1a5924704a29d5b6b0094eed45d43fc81b2863ff

  • SSDEEP

    3072:eg9CERVRUe5+WB0LuaJltOrWKDBr+yJb:eg9VFMoYLOf

Malware Config

Extracted

Family

gozi

Targets

    • Target

      7679b8182e8ed9305e92eb6a9f11c080_NeikiAnalytics

    • Size

      163KB

    • MD5

      7679b8182e8ed9305e92eb6a9f11c080

    • SHA1

      98bb8d333bcca8d66c1bed24a424ad76793c2683

    • SHA256

      4c482696a86601f00dcf573aa436cb85be21375a2e2e9255ef97ff167e3c529e

    • SHA512

      8818514b63f3c51f00ed4b822cfab7156357db8d87dee42b0656b9c66f1a208131a53b546027a8c49b67cdad1a5924704a29d5b6b0094eed45d43fc81b2863ff

    • SSDEEP

      3072:eg9CERVRUe5+WB0LuaJltOrWKDBr+yJb:eg9VFMoYLOf

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks