gozi_rm3 | 12e83053f191b0546cfde86a9995a498c8bf0c3552169c13d9c26c60b7860769 | Triage

Sharing

General

Target

12e83053f191b0546cfde86a9995a498c8bf0c3552169c13d9c26c60b7860769
Size

880KB
Sample

210910-k37flahgg5
MD5

ae44750d0e64fe0b5389b5463a4efc75
SHA1

24842970bbeff697a3452139aa0fbd1669c8d551
SHA256

12e83053f191b0546cfde86a9995a498c8bf0c3552169c13d9c26c60b7860769
SHA512

3d4183de45134123f3b065eb2c981d80ef6cb11099d5b4af2bca6ef1db2323f09af07d56c86934bb193de5375441704a70b5cfb75a14cc47fd288f1df98168bb

Score

10^/10

gozi_rm3 202108021 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300981

Extracted

Family

gozi_rm3

Botnet

202108021

C2

https://haverit.xyz

Attributes

build
300981
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  12e83053f191b0546cfde86a9995a498c8bf0c3552169c13d9c26c60b7860769
- Size
  
  880KB
- MD5
  
  ae44750d0e64fe0b5389b5463a4efc75
- SHA1
  
  24842970bbeff697a3452139aa0fbd1669c8d551
- SHA256
  
  12e83053f191b0546cfde86a9995a498c8bf0c3552169c13d9c26c60b7860769
- SHA512
  
  3d4183de45134123f3b065eb2c981d80ef6cb11099d5b4af2bca6ef1db2323f09af07d56c86934bb193de5375441704a70b5cfb75a14cc47fd288f1df98168bb
Score

10^/10

gozi_rm3 202108021 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202108021bankertrojan