Extracted

• • Target

    2b423c698f966c775a7158bba24e8440_NeikiAnalytics.exe

  • Size

    163KB

  • MD5

    2b423c698f966c775a7158bba24e8440

  • SHA1

    5fa6b1cdcee75b86235a803454a1b8f53a18f996

  • SHA256

    3ef47cbc03d3ad2764a6d38e6268bc1da824523edb00f13516064327546201da

  • SHA512

    db1f534196c0ac13774fe259a7b695ae6d7e14f5abea9e52faa0f4e1967167936dca9e1075409b941b13b1574919c4197331863ff86999c5fbccc79a5102a8ca

  • SSDEEP

    1536:PJZfd1a5WxRFnDxtVm3sCWKxhlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:xZfdY5WxPzA3sCWKxhltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2