Extracted

• • Target

    d37cb66a46d1a39651f71053d9e0da70_NeikiAnalytics

  • Size

    163KB

  • MD5

    d37cb66a46d1a39651f71053d9e0da70

  • SHA1

    8ac3283b53e9712127695709ee9a50249faf1bcd

  • SHA256

    b8f88c84657a05e7bb99c1fa0038b1dc2f516f57e69d6f6012bab77eb8b39ba2

  • SHA512

    71e84880ec23408b7ec8eecf59f6738cfbfa3f65d8bcbed6aff6600703dee69f334068231bbad5dfc54652fe6e0c07ff45fe6b6ecf6c27ee8175b023219a4732

  • SSDEEP

    1536:PNkLkUrpjRZd6weru5HvgCYbXs1lNilProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:lkLksl+FK4elEltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2