Extracted

• • Target

    a5f2039fc664fb0154b8eec8514da280_NeikiAnalytics.exe

  • Size

    163KB

  • MD5

    a5f2039fc664fb0154b8eec8514da280

  • SHA1

    efefdb8688a18d8746bb1b45cd490ea5a8fa6fa5

  • SHA256

    11160a3b83f928fc3f08bf594d242573858fac18a0925a205957729a61892e7b

  • SHA512

    dd5aa78e7a82c2dbf19ee28bb4aacc6c7f61fdec3b33d40788962f201e5b4a442d2dd14f52d887593be1eb16440affa6ce3e567ca23322f7452778bdcf1927f8

  • SSDEEP

    1536:PMpvz6isPn0UfXTuZ+j85yhOXHoOAlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:6vzVsP0SEXzAltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2