Extracted

• • Target

    3a1d6340a1914ed6710bd256c0cbf1a0_NeikiAnalytics.exe

  • Size

    163KB

  • MD5

    3a1d6340a1914ed6710bd256c0cbf1a0

  • SHA1

    6ac1a3afadc4d56c29d4963429670995c5b653f1

  • SHA256

    d5e97b52449b160912254be6abfc3e9c86cf74ab6f1052ee2e6c81287fc3b122

  • SHA512

    9aa080d99c9572d84cf9fe20b1fcc0c11a8097504099c2624b21c25703bc5ce84389993431d9e849056bd3e96453d80262c632ade78cd37ad3c8c4dc90874df0

  • SSDEEP

    1536:PLefAZ7oZmuOSKViSQsve37sYlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:jea8OSKYSQsvesYltOrWKDBr+yJb

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2