Overview

overview

10

Static

static

3

d00c00cd33...cs.exe

windows7-x64

10

d00c00cd33...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d00c00cd33946067c76c42a2fa3c8610_NeikiAnalytics

  • Size

    163KB

  • Sample

    240515-nqerlafd6x

  • MD5

    d00c00cd33946067c76c42a2fa3c8610

  • SHA1

    5b2958bb481aa7112a94dfad82e3d3c299e98cd2

  • SHA256

    a16cea9325b57ac13695f3b836b55a00734740ce8bedb0481d729f61babc3e5f

  • SHA512

    72bdcaaec259ad779f416e9aab70d66e0a7d7e8a95903422fbb71c18d75787addbff97ed5fddf8f35bcf6bc22ab195b67f4cc2406b78b66798cc10560a609bfc

  • SSDEEP

    1536:P+DJZOzBOF9AXXeoukLOd6FGlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:WdZOzCieEGltOrWKDBr+yJb

Score
10/10
gozibankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      d00c00cd33946067c76c42a2fa3c8610_NeikiAnalytics

    • Size

      163KB

    • MD5

      d00c00cd33946067c76c42a2fa3c8610

    • SHA1

      5b2958bb481aa7112a94dfad82e3d3c299e98cd2

    • SHA256

      a16cea9325b57ac13695f3b836b55a00734740ce8bedb0481d729f61babc3e5f

    • SHA512

      72bdcaaec259ad779f416e9aab70d66e0a7d7e8a95903422fbb71c18d75787addbff97ed5fddf8f35bcf6bc22ab195b67f4cc2406b78b66798cc10560a609bfc

    • SSDEEP

      1536:P+DJZOzBOF9AXXeoukLOd6FGlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:WdZOzCieEGltOrWKDBr+yJb

    Score
    10/10
    persistencegozibankerisfbtrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks