gozi_rm3 | 3654b53df830b1a9c808f005cde5b1679e027cc06aa652d5a74ef66b46cd5433 | Triage

Sharing

General

Target

3654b53df830b1a9c808f005cde5b1679e027cc06aa652d5a74ef66b46cd5433
Size

880KB
Sample

210910-hwy5jahfd7
MD5

f8a06963f874d192eebeadd0f3e5d07c
SHA1

469a7e2293edd0d4cb92efef5fef8e42eaeaaf52
SHA256

3654b53df830b1a9c808f005cde5b1679e027cc06aa652d5a74ef66b46cd5433
SHA512

d2fde5c3481ab486002127070898d6a54a9b68e598f7cd666eb51c0ef4b5d8a15629d9bea0f159d4b8b113154132355b4e9a2bd6fe026b9f959fd96f27e6af46

Score

10^/10

gozi_rm3 202108021 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300981

Extracted

Family

gozi_rm3

Botnet

202108021

C2

https://haverit.xyz

Attributes

build
300981
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  3654b53df830b1a9c808f005cde5b1679e027cc06aa652d5a74ef66b46cd5433
- Size
  
  880KB
- MD5
  
  f8a06963f874d192eebeadd0f3e5d07c
- SHA1
  
  469a7e2293edd0d4cb92efef5fef8e42eaeaaf52
- SHA256
  
  3654b53df830b1a9c808f005cde5b1679e027cc06aa652d5a74ef66b46cd5433
- SHA512
  
  d2fde5c3481ab486002127070898d6a54a9b68e598f7cd666eb51c0ef4b5d8a15629d9bea0f159d4b8b113154132355b4e9a2bd6fe026b9f959fd96f27e6af46
Score

10^/10

gozi_rm3 202108021 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202108021bankertrojan