gozi_rm3 | d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339 | Triage

Sharing

General

Target

d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339.dll
Size

60KB
Sample

210716-xrdd7e78cn
MD5

fd52ace064492971c79ae679d1326aef
SHA1

b8fb62eaf0415586a1949863c1981d543199179b
SHA256

d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339
SHA512

1249c6d8f72e45631d47bf27489761963bd2148e0c0ec1743973bbf386268cd2a9be65bc8fa6d1d9a38ada8b35e8e78f6f02a0780af12d50c461ddeec12ca10b

Score

10^/10

gozi_rm3 210307 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Botnet

210307

C2

https://thetopdomain.xyz

Attributes

build
300960
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339.dll
- Size
  
  60KB
- MD5
  
  fd52ace064492971c79ae679d1326aef
- SHA1
  
  b8fb62eaf0415586a1949863c1981d543199179b
- SHA256
  
  d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339
- SHA512
  
  1249c6d8f72e45631d47bf27489761963bd2148e0c0ec1743973bbf386268cd2a9be65bc8fa6d1d9a38ada8b35e8e78f6f02a0780af12d50c461ddeec12ca10b
Score

10^/10

gozi_rm3 210307 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3210307bankertrojan

behavioral2

gozi_rm3210307bankertrojan