Extracted

• • Target

    e1e932a6e7ba459276f8c397c1edc600_NeikiAnalytics.exe

  • Size

    163KB

  • MD5

    e1e932a6e7ba459276f8c397c1edc600

  • SHA1

    8baa25f8fc736931d64bd7d25fb9b265dff13269

  • SHA256

    10c51945fe512ad36c763c2e587208891bbe2f0bf685502b3c0c8cbd5e424b0a

  • SHA512

    342d90ca3a03af3816290b94eab9a803a98e224ee1d8ef203f004f96277f1f64f4b25c11d56eae9038f33cb8fde2f184e28440c1d88136a663db64e5e89d8eb5

  • SSDEEP

    1536:PXVws2L9gRIs3Kr4zrlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:fw9gyurltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2