Overview

overview

10

Static

static

3

37531f1427...cs.exe

windows7-x64

10

37531f1427...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37531f1427fd1ca04ba0fdb019b7c060_NeikiAnalytics.exe

  • Size

    163KB

  • Sample

    240519-a1fjzshb92

  • MD5

    37531f1427fd1ca04ba0fdb019b7c060

  • SHA1

    c8c15f79996d9f591ab79695f0bb93db1057c593

  • SHA256

    23e660244272a1428b7591bed1c32c7abc634b8bdb8257a0de60a9f9aa03f6d7

  • SHA512

    a12cba7ca80390b7042af8facc696c920e0c1477b5299291f9fddb069f2a5ce675a09694cd23825aea776b8d436b4fd4f97b789ceb2f4bf04495a02088fea518

  • SSDEEP

    1536:PqetPtynIP/iDpkfa5riS9F9Iq25dYPzwlProNVU4qNVUrk/9QbfBr+7GwKrPAsf:HdtyI3iDpkfqrimIkMltOrWKDBr+yJb

Score
10/10
gozibankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      37531f1427fd1ca04ba0fdb019b7c060_NeikiAnalytics.exe

    • Size

      163KB

    • MD5

      37531f1427fd1ca04ba0fdb019b7c060

    • SHA1

      c8c15f79996d9f591ab79695f0bb93db1057c593

    • SHA256

      23e660244272a1428b7591bed1c32c7abc634b8bdb8257a0de60a9f9aa03f6d7

    • SHA512

      a12cba7ca80390b7042af8facc696c920e0c1477b5299291f9fddb069f2a5ce675a09694cd23825aea776b8d436b4fd4f97b789ceb2f4bf04495a02088fea518

    • SSDEEP

      1536:PqetPtynIP/iDpkfa5riS9F9Iq25dYPzwlProNVU4qNVUrk/9QbfBr+7GwKrPAsf:HdtyI3iDpkfqrimIkMltOrWKDBr+yJb

    Score
    10/10
    persistencegozibankerisfbtrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks