gozi_rm3 | 1be1024b570b8df27c37151e0d09863ee1bd3bb503b9589f25962a1d32339a99 | Triage

Sharing

General

Target

1be1024b570b8df27c37151e0d09863ee1bd3bb503b9589f25962a1d32339a99
Size

880KB
Sample

210910-k38zeshgg7
MD5

dab7afdab5cdd13f9b6f77f0ddcac7d9
SHA1

4e306b0ff0df93370e5811fbf7b6069d9d64be9e
SHA256

1be1024b570b8df27c37151e0d09863ee1bd3bb503b9589f25962a1d32339a99
SHA512

0218417fa14fead64049437992c9a30e4d1951387997816ba0f738e55fa712c0420bf73966db625aea15701b1260fae2c13b5d13fd769b33d7c2de204a1d3bd4

Score

10^/10

gozi_rm3 202108021 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300981

Extracted

Family

gozi_rm3

Botnet

202108021

C2

https://haverit.xyz

Attributes

build
300981
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  1be1024b570b8df27c37151e0d09863ee1bd3bb503b9589f25962a1d32339a99
- Size
  
  880KB
- MD5
  
  dab7afdab5cdd13f9b6f77f0ddcac7d9
- SHA1
  
  4e306b0ff0df93370e5811fbf7b6069d9d64be9e
- SHA256
  
  1be1024b570b8df27c37151e0d09863ee1bd3bb503b9589f25962a1d32339a99
- SHA512
  
  0218417fa14fead64049437992c9a30e4d1951387997816ba0f738e55fa712c0420bf73966db625aea15701b1260fae2c13b5d13fd769b33d7c2de204a1d3bd4
Score

10^/10

gozi_rm3 202108021 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202108021bankertrojan