Extracted

• • Target

    1f059050cf707d89e9c3430ca1a20bb0_NeikiAnalytics.exe

  • Size

    163KB

  • MD5

    1f059050cf707d89e9c3430ca1a20bb0

  • SHA1

    fcd8297fc2fbaf0d67620d50a60a93c3ee0d1a6b

  • SHA256

    c36d91409e33a9210ee16c9be46118d1766ca5ad50aaeb9d7fc9e1d7c611036a

  • SHA512

    ed5aa7ee2936077706535cc790ca10fc8d7e7559f3204eef997598cdf31767a823039afb1e5482be34c298edda97fc74d209256681cc9e26934e5ddc66967ce6

  • SSDEEP

    3072:aeqDeVP4KAaUBPHaOcPltOrWKDBr+yJb:ae5dclP6OcPLOf

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2