gozi_rm3 | 6a83cc4b98bb4b1f938c1decb6ce8c38b398bb22d48e70068daa58697fc9a7c7 | Triage

Sharing

General

Target

6a83cc4b98bb4b1f938c1decb6ce8c38b398bb22d48e70068daa58697fc9a7c7
Size

880KB
Sample

210910-mrd11shhh3
MD5

4f4aaa9d44ae7e1791b4fbb60572e4a1
SHA1

59b5447b5d9b75500c37f964fe1a53c868c558ea
SHA256

6a83cc4b98bb4b1f938c1decb6ce8c38b398bb22d48e70068daa58697fc9a7c7
SHA512

4e519825a92ce7c9d6cd7f3effd18e8830cb614afb653cd5cea722df6e9bcf9828672c82f0e6198125d63aabee2f078793086f078cd94f9e79359f637e31d8cf

Score

10^/10

gozi_rm3 202108021 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300981

Extracted

Family

gozi_rm3

Botnet

202108021

C2

https://haverit.xyz

Attributes

build
300981
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  6a83cc4b98bb4b1f938c1decb6ce8c38b398bb22d48e70068daa58697fc9a7c7
- Size
  
  880KB
- MD5
  
  4f4aaa9d44ae7e1791b4fbb60572e4a1
- SHA1
  
  59b5447b5d9b75500c37f964fe1a53c868c558ea
- SHA256
  
  6a83cc4b98bb4b1f938c1decb6ce8c38b398bb22d48e70068daa58697fc9a7c7
- SHA512
  
  4e519825a92ce7c9d6cd7f3effd18e8830cb614afb653cd5cea722df6e9bcf9828672c82f0e6198125d63aabee2f078793086f078cd94f9e79359f637e31d8cf
Score

10^/10

gozi_rm3 202108021 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202108021bankertrojan