gozi_rm3 | 31b94c5a94aa8ce7e187360b0dc702b473d1c5d498d4de26f137b272ccbadaed | Triage

Sharing

General

Target

31b94c5a94aa8ce7e187360b0dc702b473d1c5d498d4de26f137b272ccbadaed
Size

315KB
Sample

210624-nk1hjgpgv2
MD5

99246958839423b9af0d2ea872c505d9
SHA1

6aba8c858610174bcff3c9cee57d8f7bc5d11564
SHA256

31b94c5a94aa8ce7e187360b0dc702b473d1c5d498d4de26f137b272ccbadaed
SHA512

b72cc152f2bb3799d678b4b371a85167ba441483a17d9a1c736df2a111abb0ad4ef7494939ed557ab25931a7fa35db52d0211f6899ed5a92f7e98756dfc0337e

Score

10^/10

gozi_rm3 202106191 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300974

Extracted

Family

gozi_rm3

Botnet

202106191

C2

https://gogorobest.xyz

Attributes

build
300974
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  31b94c5a94aa8ce7e187360b0dc702b473d1c5d498d4de26f137b272ccbadaed
- Size
  
  315KB
- MD5
  
  99246958839423b9af0d2ea872c505d9
- SHA1
  
  6aba8c858610174bcff3c9cee57d8f7bc5d11564
- SHA256
  
  31b94c5a94aa8ce7e187360b0dc702b473d1c5d498d4de26f137b272ccbadaed
- SHA512
  
  b72cc152f2bb3799d678b4b371a85167ba441483a17d9a1c736df2a111abb0ad4ef7494939ed557ab25931a7fa35db52d0211f6899ed5a92f7e98756dfc0337e
Score

10^/10

gozi_rm3 202106191 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gozi_rm3202106191bankertrojan

behavioral2

gozi_rm3202106191bankertrojan