Overview

overview

10

Static

static

3

265ca48af5...cs.exe

windows7-x64

10

265ca48af5...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    265ca48af5076940f0040a4b135c1134d0e148f30ea07afef784240c6b6b614c_NeikiAnalytics

  • Size

    163KB

  • Sample

    240521-kvwn5afd44

  • MD5

    b1df5e908ae76509f60afc5d1a03f040

  • SHA1

    67b366f7c7b5935e660f81c1087e0721852d1ebc

  • SHA256

    265ca48af5076940f0040a4b135c1134d0e148f30ea07afef784240c6b6b614c

  • SHA512

    c9fbac450e9ec912a5e4e4a873efb4c2330df13ce79716153491641302aa5cd6ea80a80e794b000d0cbd5293855a1307ebd174b1ec3b0f7cac1be66602cbfe1d

  • SSDEEP

    3072:+KBm9xOF5iyNCKVtOuvltOrWKDBr+yJb:+lbu9zvLOf

Score
10/10
gozibankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      265ca48af5076940f0040a4b135c1134d0e148f30ea07afef784240c6b6b614c_NeikiAnalytics

    • Size

      163KB

    • MD5

      b1df5e908ae76509f60afc5d1a03f040

    • SHA1

      67b366f7c7b5935e660f81c1087e0721852d1ebc

    • SHA256

      265ca48af5076940f0040a4b135c1134d0e148f30ea07afef784240c6b6b614c

    • SHA512

      c9fbac450e9ec912a5e4e4a873efb4c2330df13ce79716153491641302aa5cd6ea80a80e794b000d0cbd5293855a1307ebd174b1ec3b0f7cac1be66602cbfe1d

    • SSDEEP

      3072:+KBm9xOF5iyNCKVtOuvltOrWKDBr+yJb:+lbu9zvLOf

    Score
    10/10
    gozibankerisfbpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks