Extracted

• • Target

    9efa61d7b1d1e6c2f306a15557a53da0_NeikiAnalytics.exe

  • Size

    163KB

  • MD5

    9efa61d7b1d1e6c2f306a15557a53da0

  • SHA1

    3acebadce708dfc319013df4b5c391fb4ad15686

  • SHA256

    c0ab00c594a4a0e37567f2646b17c1343e0d5c6df5fa23b513729570ab1c26e0

  • SHA512

    913ec73f27fe7bb6ffd7871a4b94ca91e33cde6d14f5974bfde828063f851eb2c9f0cb430b29728b9d81cd70a3a510f607fe9f59ada826d9ba27bda042d5a072

  • SSDEEP

    1536:PSTy8yi0ku3P8hH9vpDJw15pAnzi36pxYtH2MOpeBSnlProNVU4qNVUrk/9QbfBR:aTyxD4ikwIltOrWKDBr+yJb

  Score

  10^/10

  gozibankerisfbpersistencetrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2