gozi_rm3 | e92464bad714b0b57507eb68862940def92109d714387dcbdf832e1c1ca10b5a | Triage

Sharing

General

Target

e92464bad714b0b57507eb68862940def92109d714387dcbdf832e1c1ca10b5a
Size

880KB
Sample

210910-hm2t3acgbl
MD5

95bc024a2c8341dc27276b758e03490b
SHA1

9e66695b193ae288014e7dc73c798cbbe8ee01a0
SHA256

e92464bad714b0b57507eb68862940def92109d714387dcbdf832e1c1ca10b5a
SHA512

a583b60518c3ac504a6ff20bedd2612fefaf7caee66b9f4b7e9bcad5496f978ad334d334e080a25b1c35156d301355d091033fbbbfaae6f99cf7542a83d8cdb1

Score

10^/10

gozi_rm3 202108021 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300981

Extracted

Family

gozi_rm3

Botnet

202108021

C2

https://haverit.xyz

Attributes

build
300981
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  e92464bad714b0b57507eb68862940def92109d714387dcbdf832e1c1ca10b5a
- Size
  
  880KB
- MD5
  
  95bc024a2c8341dc27276b758e03490b
- SHA1
  
  9e66695b193ae288014e7dc73c798cbbe8ee01a0
- SHA256
  
  e92464bad714b0b57507eb68862940def92109d714387dcbdf832e1c1ca10b5a
- SHA512
  
  a583b60518c3ac504a6ff20bedd2612fefaf7caee66b9f4b7e9bcad5496f978ad334d334e080a25b1c35156d301355d091033fbbbfaae6f99cf7542a83d8cdb1
Score

10^/10

gozi_rm3 202108021 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202108021bankertrojan