Extracted

• • Target

    221a7078bbbc8444f74d970766f724ece6cb69d71e164fd3536b08ae5057c98d_NeikiAnalytics.exe

  • Size

    163KB

  • MD5

    c32c1faa1110508bc79bed7c73fba880

  • SHA1

    600c832b444c7e8a3f8dcc292f85fc63dc41b858

  • SHA256

    221a7078bbbc8444f74d970766f724ece6cb69d71e164fd3536b08ae5057c98d

  • SHA512

    a313da122b5de356a9a2db7cd1e2891d338c10b880e49eb77bb4af6f781eff5af2fb6a68787d055f74257e0c804f5a4ddd4c65901e8257181dd3c0c224bdf0fd

  • SSDEEP

    3072:ls3klIdvjFHq4N/p8yRtTCrWcyltOrWKDBr+yJb:OTcyLOf

  Score

  10^/10

  persistencegozibankerisfbtrojan

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2