gozi_rm3 | 6060522fe92a665e7c63320d7c7dafe247ce08d5c73a754fdbc861cc0bc7ee64 | Triage

Sharing

General

Target

6060522fe92a665e7c63320d7c7dafe247ce08d5c73a754fdbc861cc0bc7ee64
Size

880KB
Sample

210910-jnpfsshfg7
MD5

3e7dc8226e0004b947b2761e6897567d
SHA1

403bae57e5b844fd82026b2c919e5cb592b040a6
SHA256

6060522fe92a665e7c63320d7c7dafe247ce08d5c73a754fdbc861cc0bc7ee64
SHA512

35d68a08a5b1f90e887f449997fa49d3978865cde6c8229419c07934d9220d948193d02f18625d5e4a363d718c6b8e79ad850b57b3174effe0eababe8acde84a

Score

10^/10

gozi_rm3 202108021 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300981

Extracted

Family

gozi_rm3

Botnet

202108021

C2

https://haverit.xyz

Attributes

build
300981
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  6060522fe92a665e7c63320d7c7dafe247ce08d5c73a754fdbc861cc0bc7ee64
- Size
  
  880KB
- MD5
  
  3e7dc8226e0004b947b2761e6897567d
- SHA1
  
  403bae57e5b844fd82026b2c919e5cb592b040a6
- SHA256
  
  6060522fe92a665e7c63320d7c7dafe247ce08d5c73a754fdbc861cc0bc7ee64
- SHA512
  
  35d68a08a5b1f90e887f449997fa49d3978865cde6c8229419c07934d9220d948193d02f18625d5e4a363d718c6b8e79ad850b57b3174effe0eababe8acde84a
Score

10^/10

gozi_rm3 202108021 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202108021bankertrojan