Overview

overview

10

Static

static

3

76b4cc9d63...cs.exe

windows7-x64

10

76b4cc9d63...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe

  • Size

    163KB

  • Sample

    240531-et9ayaef9w

  • MD5

    76b4cc9d635e09f843a8dd3d36014870

  • SHA1

    8f13fc7d162224b7818d5fdf5d8a915e36386382

  • SHA256

    f154301684cf6431af11e44004ac99e2b523ae2c002baac36dc912b5d5eca039

  • SHA512

    981bc4156a2be9ea98396451b14a2c3b5719db0a280eed9acafcf19661712762cab4253d1abfd7352e1577bc90db766817aeeffaa583c57522a43024a0a48904

  • SSDEEP

    1536:Pbn+i+fGEY0SVD1GwjRfoEZlkCcclProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:LifG0A1JjRjZecltOrWKDBr+yJb

Score
10/10
gozibankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Targets

    • Target

      76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe

    • Size

      163KB

    • MD5

      76b4cc9d635e09f843a8dd3d36014870

    • SHA1

      8f13fc7d162224b7818d5fdf5d8a915e36386382

    • SHA256

      f154301684cf6431af11e44004ac99e2b523ae2c002baac36dc912b5d5eca039

    • SHA512

      981bc4156a2be9ea98396451b14a2c3b5719db0a280eed9acafcf19661712762cab4253d1abfd7352e1577bc90db766817aeeffaa583c57522a43024a0a48904

    • SSDEEP

      1536:Pbn+i+fGEY0SVD1GwjRfoEZlkCcclProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:LifG0A1JjRjZecltOrWKDBr+yJb

    Score
    10/10
    gozibankerisfbpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks