Extracted

• • Target

    d9994635de7fd82e8f29a21600041320_NeikiAnalytics

  • Size

    163KB

  • MD5

    d9994635de7fd82e8f29a21600041320

  • SHA1

    0e8e9581c0e63f508cdbdb10cba9ed4901c0d807

  • SHA256

    8d147f358f24feaf5267c64ba5f4f862fe77c99dda2eae62b37aa77d56f93639

  • SHA512

    d9c3cb5e8a2aa1b1a5ff7661550e79a55ff428f1a403005e2e0221a5e9241448308888eda6af4e3ecf5ad4675c272968abda36446499720ca297425883ae19e7

  • SSDEEP

    1536:PyWukXzvZ3SiNrikAkQYTJaieK8cD+1lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:6WL7riFCsieKTmltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2