Overview

overview

10

Static

static

PiSUfsy.exe

windows7_x64

10

Resubmissions

12-09-2021 05:03

210912-fp66fsehgn 10

10-09-2021 08:18

210910-j7bdaacghm 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PiSUfsy.exe

  • Size

    880KB

  • Sample

    210912-fp66fsehgn

  • MD5

    ddb8cc4e8e2ec81904a1407409d2e868

  • SHA1

    5f594f30bcf6b00213916e5aa987db98d764fbb2

  • SHA256

    e0f81b847c0c02e0352607f852bdfb651925c35655ebf0be9b4fd2ef034661f3

  • SHA512

    70e1ff1b5aa7a5ff7408f4520adece23fbb9df4f3ac9d5aded9baad30fe485c47a2f8cce6b2d500ab6705a18ce20f90c193092c4f943053c67c1cff8b51a5738

Score
10/10
gozi_rm3202108021bankertrojan

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300981

Extracted

Family

gozi_rm3

Botnet

202108021

C2

https://haverit.xyz

Attributes
  • build

    300981

  • exe_type

    loader

  • non_target_locale

    RU

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
aes.plain

Targets

    • Target

      PiSUfsy.exe

    • Size

      880KB

    • MD5

      ddb8cc4e8e2ec81904a1407409d2e868

    • SHA1

      5f594f30bcf6b00213916e5aa987db98d764fbb2

    • SHA256

      e0f81b847c0c02e0352607f852bdfb651925c35655ebf0be9b4fd2ef034661f3

    • SHA512

      70e1ff1b5aa7a5ff7408f4520adece23fbb9df4f3ac9d5aded9baad30fe485c47a2f8cce6b2d500ab6705a18ce20f90c193092c4f943053c67c1cff8b51a5738

    Score
    10/10
    gozi_rm3202108021bankertrojan

    • Gozi RM3

      A heavily modified version of Gozi using RM3 loader.

      bankertrojangozi_rm3

    • win_isfb_auto

      Detects win.isfb.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks