Overview

overview

10

Static

static

3

06fcda0a0e...cs.exe

windows7-x64

10

06fcda0a0e...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06fcda0a0e923ec22a8cf0546795f620_NeikiAnalytics

  • Size

    163KB

  • Sample

    240515-vkjxpaba52

  • MD5

    06fcda0a0e923ec22a8cf0546795f620

  • SHA1

    87f256868f3652586d1d9f4700b346ae01605d43

  • SHA256

    f297ac15619b88a1895cce2ff6b834dded0ab2085e2fe42adb02d1cb67c66dd4

  • SHA512

    2655627433b398706a03cf5c36a2dfe66d6b5b18680b1a72980af6b7b07aa7818f05a9a3fa4bbf07aaa6e2978471b11cfe08991776bebbb1138b7a507833b4e1

  • SSDEEP

    3072:mUPZX0nh1WombW58X3H5PltOrWKDBr+yJb:mUPZXkh1WtW58nZPLOf

Score
10/10
gozibankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      06fcda0a0e923ec22a8cf0546795f620_NeikiAnalytics

    • Size

      163KB

    • MD5

      06fcda0a0e923ec22a8cf0546795f620

    • SHA1

      87f256868f3652586d1d9f4700b346ae01605d43

    • SHA256

      f297ac15619b88a1895cce2ff6b834dded0ab2085e2fe42adb02d1cb67c66dd4

    • SHA512

      2655627433b398706a03cf5c36a2dfe66d6b5b18680b1a72980af6b7b07aa7818f05a9a3fa4bbf07aaa6e2978471b11cfe08991776bebbb1138b7a507833b4e1

    • SSDEEP

      3072:mUPZX0nh1WombW58X3H5PltOrWKDBr+yJb:mUPZXkh1WtW58nZPLOf

    Score
    10/10
    persistencegozibankerisfbtrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks