gozi_rm3 | b3389168c34c5440bad3aa7751e8be7db1c30a1b7fb34c450cf73a050fe00fae | Triage

Sharing

General

Target

b3389168c34c5440bad3aa7751e8be7db1c30a1b7fb34c450cf73a050fe00fae
Size

880KB
Sample

210910-mrfvlshhh8
MD5

bfad77d55f8d6b68bd72410f22cc5a34
SHA1

df83f6eb18344dc37e1cabae0c0b56c3c26152e8
SHA256

b3389168c34c5440bad3aa7751e8be7db1c30a1b7fb34c450cf73a050fe00fae
SHA512

281bb83a22bb8b5014b228a5448cd822762a2d07594fa403e49552701843e4489b847986d095bf365a6cf29a2dc21fe0e8e7a1b56924ed68797281a17d2b9e0a

Score

10^/10

gozi_rm3 202108021 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300981

Extracted

Family

gozi_rm3

Botnet

202108021

C2

https://haverit.xyz

Attributes

build
300981
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  b3389168c34c5440bad3aa7751e8be7db1c30a1b7fb34c450cf73a050fe00fae
- Size
  
  880KB
- MD5
  
  bfad77d55f8d6b68bd72410f22cc5a34
- SHA1
  
  df83f6eb18344dc37e1cabae0c0b56c3c26152e8
- SHA256
  
  b3389168c34c5440bad3aa7751e8be7db1c30a1b7fb34c450cf73a050fe00fae
- SHA512
  
  281bb83a22bb8b5014b228a5448cd822762a2d07594fa403e49552701843e4489b847986d095bf365a6cf29a2dc21fe0e8e7a1b56924ed68797281a17d2b9e0a
Score

10^/10

gozi_rm3 202108021 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202108021bankertrojan