gozi_rm3 | 8f6ee0292d691bd26c1faf3c18ab30956f00a1cdc4e93a26958a559d96b400c0 | Triage

Resubmissions

09-03-2021 16:06

210309-kxbe8wzgge 10

04-03-2020 00:31

200304-v9yphrchmj 10

Sharing

General

Target

6516805C322B33C1017F60314548D9A6
Size

583KB
Sample

210309-kxbe8wzgge
MD5

6516805c322b33c1017f60314548d9a6
SHA1

bf46387cc42242434ba8aa788974a3f851e12e85
SHA256

8f6ee0292d691bd26c1faf3c18ab30956f00a1cdc4e93a26958a559d96b400c0
SHA512

c81c4c963bced891449458ea0936dab5e9eea904e78ef2fd3fcbd43aae49cb60c5343c0bc1756fa6f5efdd312dc2dc6fd0d698246cb56743435260796f74432c

Score

10^/10

gozi_rm3 40000 banker cryptone packer trojan

Malware Config

Extracted

Family

gozi_rm3

Botnet

40000

C2

https://fleekstar.xyz

Attributes

build
300848
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.base64

serpent.plain

Targets

- Target
  
  6516805C322B33C1017F60314548D9A6
- Size
  
  583KB
- MD5
  
  6516805c322b33c1017f60314548d9a6
- SHA1
  
  bf46387cc42242434ba8aa788974a3f851e12e85
- SHA256
  
  8f6ee0292d691bd26c1faf3c18ab30956f00a1cdc4e93a26958a559d96b400c0
- SHA512
  
  c81c4c963bced891449458ea0936dab5e9eea904e78ef2fd3fcbd43aae49cb60c5343c0bc1756fa6f5efdd312dc2dc6fd0d698246cb56743435260796f74432c
Score

10^/10

gozi_rm3 40000 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gozi_rm340000bankertrojan