Overview

overview

10

Static

static

ioir.png.dll

windows7_x64

10

ioir.png.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ioir.png.dll

  • Size

    539KB

  • Sample

    210205-1vr3kmngqj

  • MD5

    d31c0491f522d6b9f2102109bd2420af

  • SHA1

    dc1cccf0e43ec5a68326ae4faf1a8cbc5ac00708

  • SHA256

    f7c79c0c3feb7c0032424f5f6a9bcdf78d1815ee53f807cc192c2c1f8f21270f

  • SHA512

    48d659660654800da4eb3909a06572dfcf5f05ebdfb8629fafdfeab601673e3377d9a3a241f4bd36c3f4f912ac838dbc73926f734bfa8a76ec43fa726b28c3bd

Score
10/10
gozi_rm3201193207bankertrojan

Malware Config

Extracted

Family

gozi_rm3

Botnet

201193207

C2

https://topitophug.xyz

Attributes
  • build

    300932

  • exe_type

    loader

rsa_pubkey.base64
serpent.plain

Targets

    • Target

      ioir.png.dll

    • Size

      539KB

    • MD5

      d31c0491f522d6b9f2102109bd2420af

    • SHA1

      dc1cccf0e43ec5a68326ae4faf1a8cbc5ac00708

    • SHA256

      f7c79c0c3feb7c0032424f5f6a9bcdf78d1815ee53f807cc192c2c1f8f21270f

    • SHA512

      48d659660654800da4eb3909a06572dfcf5f05ebdfb8629fafdfeab601673e3377d9a3a241f4bd36c3f4f912ac838dbc73926f734bfa8a76ec43fa726b28c3bd

    Score
    10/10
    gozi_rm3201193207bankertrojan

    • Gozi RM3

      A heavily modified version of Gozi using RM3 loader.

      bankertrojangozi_rm3

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks