gozi_rm3 | ddbf17981fed857e966ff809166b6d320e04d8527690090db8c51cd604ea4b9f | Triage

Resubmissions

01-02-2022 09:04

220201-k1zb7sbhdj 10

01-02-2022 08:59

220201-kx9c1acde6 10

Sharing

General

Target

ddbf17981fed857e966ff809166b6d320e04d8527690090db8c51cd604ea4b9f
Size

42KB
Sample

220201-k1zb7sbhdj
MD5

9119c48e34aa0b5b10732abb8a899377
SHA1

c5a0c2dc7507ade864018a783cf12587f6cfc8d6
SHA256

ddbf17981fed857e966ff809166b6d320e04d8527690090db8c51cd604ea4b9f
SHA512

1cd03786a39de37b9e087626ca1ddbb3b4f6e26e6d54c790d7035a6f9e7fb468d9b4186f86c6c58f86b769fee83afd7c88da18f73ec4c44567215fa11fd05945

Score

10^/10

gozi_rm3 202003272 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300854

Extracted

Family

gozi_rm3

Botnet

202003272

C2

https://lidesignexpo.com

Attributes

build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  ddbf17981fed857e966ff809166b6d320e04d8527690090db8c51cd604ea4b9f
- Size
  
  42KB
- MD5
  
  9119c48e34aa0b5b10732abb8a899377
- SHA1
  
  c5a0c2dc7507ade864018a783cf12587f6cfc8d6
- SHA256
  
  ddbf17981fed857e966ff809166b6d320e04d8527690090db8c51cd604ea4b9f
- SHA512
  
  1cd03786a39de37b9e087626ca1ddbb3b4f6e26e6d54c790d7035a6f9e7fb468d9b4186f86c6c58f86b769fee83afd7c88da18f73ec4c44567215fa11fd05945
Score

10^/10

gozi_rm3 202003272 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202003272bankertrojan