Overview

overview

10

Static

static

3

ff1724f682...cs.exe

windows7-x64

10

ff1724f682...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff1724f6826bc57e02f3411f611e7750_NeikiAnalytics.exe

  • Size

    163KB

  • Sample

    240523-hm9vnsgg43

  • MD5

    ff1724f6826bc57e02f3411f611e7750

  • SHA1

    b039aa14e5a766f9a1a3ec30920e7a1b6a26d38c

  • SHA256

    e76b216f2dd4abc0945fbd254a7c86de1598be95846760627039e06f1721bc40

  • SHA512

    bc32cb6c8008e9c4ff80f82e84a1a477556fa7890406777bdbad80ab9beffb079ae4da9d85c819bf85b76e742055989975f1c5199cc26e5a62964c8287c7b0bd

  • SSDEEP

    1536:P28X6APXVyRxGreXkEncPNvsylProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:e8fdyRxGrQ5uvsyltOrWKDBr+yJb

Score
10/10
gozibankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      ff1724f6826bc57e02f3411f611e7750_NeikiAnalytics.exe

    • Size

      163KB

    • MD5

      ff1724f6826bc57e02f3411f611e7750

    • SHA1

      b039aa14e5a766f9a1a3ec30920e7a1b6a26d38c

    • SHA256

      e76b216f2dd4abc0945fbd254a7c86de1598be95846760627039e06f1721bc40

    • SHA512

      bc32cb6c8008e9c4ff80f82e84a1a477556fa7890406777bdbad80ab9beffb079ae4da9d85c819bf85b76e742055989975f1c5199cc26e5a62964c8287c7b0bd

    • SSDEEP

      1536:P28X6APXVyRxGreXkEncPNvsylProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:e8fdyRxGrQ5uvsyltOrWKDBr+yJb

    Score
    10/10
    gozibankerisfbpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks