Overview

overview

10

Static

static

3

e1e932a6e7...cs.exe

windows7-x64

10

e1e932a6e7...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1e932a6e7ba459276f8c397c1edc600_NeikiAnalytics.exe

  • Size

    163KB

  • Sample

    240520-lxkkbaec44

  • MD5

    e1e932a6e7ba459276f8c397c1edc600

  • SHA1

    8baa25f8fc736931d64bd7d25fb9b265dff13269

  • SHA256

    10c51945fe512ad36c763c2e587208891bbe2f0bf685502b3c0c8cbd5e424b0a

  • SHA512

    342d90ca3a03af3816290b94eab9a803a98e224ee1d8ef203f004f96277f1f64f4b25c11d56eae9038f33cb8fde2f184e28440c1d88136a663db64e5e89d8eb5

  • SSDEEP

    1536:PXVws2L9gRIs3Kr4zrlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:fw9gyurltOrWKDBr+yJb

Score
10/10
gozibankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      e1e932a6e7ba459276f8c397c1edc600_NeikiAnalytics.exe

    • Size

      163KB

    • MD5

      e1e932a6e7ba459276f8c397c1edc600

    • SHA1

      8baa25f8fc736931d64bd7d25fb9b265dff13269

    • SHA256

      10c51945fe512ad36c763c2e587208891bbe2f0bf685502b3c0c8cbd5e424b0a

    • SHA512

      342d90ca3a03af3816290b94eab9a803a98e224ee1d8ef203f004f96277f1f64f4b25c11d56eae9038f33cb8fde2f184e28440c1d88136a663db64e5e89d8eb5

    • SSDEEP

      1536:PXVws2L9gRIs3Kr4zrlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:fw9gyurltOrWKDBr+yJb

    Score
    10/10
    persistencegozibankerisfbtrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks