Extracted

• • Target

    ad544b5c99eecaeb119f0773ccf75cb0_NeikiAnalytics

  • Size

    163KB

  • MD5

    ad544b5c99eecaeb119f0773ccf75cb0

  • SHA1

    c868167fcc9e0e9b530365bbb2ff0d5b287e90ea

  • SHA256

    34e89893e3e49d6116de3f20a4bf81fcdfe0d3bdab3197a9a9c74040469eb083

  • SHA512

    0d700f48d0bc1ed22b95efbc4aad2fa5c1a53909d1694e4dee4df409c6593612b3987de80fd283984cbac8711be91ad923a158afb0ce2920ef9bc4c98e5f3c3d

  • SSDEEP

    3072:Dza4CvHQHAhZK/P6Lmt1Dj/KbltOrWKDBr+yJb:DW4CvwghZK/P6G+bLOf

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2