gozi_rm3 | dcb0bf9379da869adea887420d865dee4fce05ce642f50206c1796416eba0bbf | Triage

Sharing

General

Target

dcb0bf9379da869adea887420d865dee4fce05ce642f50206c1796416eba0bbf
Size

880KB
Sample

210910-h6h63acgdn
MD5

26691ed9868b7564108fcb209a9f1a8d
SHA1

897a08d951d805a41a2e7a4769b8bc2501a13f37
SHA256

dcb0bf9379da869adea887420d865dee4fce05ce642f50206c1796416eba0bbf
SHA512

b1f5bbaf3ab422811dc8bff00e227c38802325085089ed829ade6309973014e5858384c54ba14d9dad3b979bdc61661638731d535ca054faad64fe667113ead1

Score

10^/10

gozi_rm3 202108021 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300981

Extracted

Family

gozi_rm3

Botnet

202108021

C2

https://haverit.xyz

Attributes

build
300981
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  dcb0bf9379da869adea887420d865dee4fce05ce642f50206c1796416eba0bbf
- Size
  
  880KB
- MD5
  
  26691ed9868b7564108fcb209a9f1a8d
- SHA1
  
  897a08d951d805a41a2e7a4769b8bc2501a13f37
- SHA256
  
  dcb0bf9379da869adea887420d865dee4fce05ce642f50206c1796416eba0bbf
- SHA512
  
  b1f5bbaf3ab422811dc8bff00e227c38802325085089ed829ade6309973014e5858384c54ba14d9dad3b979bdc61661638731d535ca054faad64fe667113ead1
Score

10^/10

gozi_rm3 202108021 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202108021bankertrojan