Overview

overview

10

Static

static

3

d9994635de...cs.exe

windows7-x64

10

d9994635de...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9994635de7fd82e8f29a21600041320_NeikiAnalytics

  • Size

    163KB

  • Sample

    240516-ly65psfb3w

  • MD5

    d9994635de7fd82e8f29a21600041320

  • SHA1

    0e8e9581c0e63f508cdbdb10cba9ed4901c0d807

  • SHA256

    8d147f358f24feaf5267c64ba5f4f862fe77c99dda2eae62b37aa77d56f93639

  • SHA512

    d9c3cb5e8a2aa1b1a5ff7661550e79a55ff428f1a403005e2e0221a5e9241448308888eda6af4e3ecf5ad4675c272968abda36446499720ca297425883ae19e7

  • SSDEEP

    1536:PyWukXzvZ3SiNrikAkQYTJaieK8cD+1lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:6WL7riFCsieKTmltOrWKDBr+yJb

Score
10/10
gozibankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      d9994635de7fd82e8f29a21600041320_NeikiAnalytics

    • Size

      163KB

    • MD5

      d9994635de7fd82e8f29a21600041320

    • SHA1

      0e8e9581c0e63f508cdbdb10cba9ed4901c0d807

    • SHA256

      8d147f358f24feaf5267c64ba5f4f862fe77c99dda2eae62b37aa77d56f93639

    • SHA512

      d9c3cb5e8a2aa1b1a5ff7661550e79a55ff428f1a403005e2e0221a5e9241448308888eda6af4e3ecf5ad4675c272968abda36446499720ca297425883ae19e7

    • SSDEEP

      1536:PyWukXzvZ3SiNrikAkQYTJaieK8cD+1lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:6WL7riFCsieKTmltOrWKDBr+yJb

    Score
    10/10
    persistencegozibankerisfbtrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks