gozi_rm3 | fd778cd2f02d549347df0cae2f1a55cfc2d6f73e975d8b88489d04d2447f7ebc | Triage

Sharing

General

Target

fd778cd2f02d549347df0cae2f1a55cfc2d6f73e975d8b88489d04d2447f7ebc
Size

52KB
Sample

220201-kmhsasbfcn
MD5

ed380a4338d439ca09a6e375501a72c8
SHA1

11b4d0d7a4fc1294c4a26a12f491f1019c9b9c17
SHA256

fd778cd2f02d549347df0cae2f1a55cfc2d6f73e975d8b88489d04d2447f7ebc
SHA512

2e1a7c539ee1386141da7954de7e090e70018140c143dcc039c9463738a7893a45a657655ee81d0791624344c3bc36112e0df93503ab0d9f477a8879c37d2ae2

Score

10^/10

gozi_rm3 86920234 banker persistence trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300898

Extracted

Family

gozi_rm3

Botnet

86920234

C2

https://susanslewis.xyz

Attributes

build
300898
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  fd778cd2f02d549347df0cae2f1a55cfc2d6f73e975d8b88489d04d2447f7ebc
- Size
  
  52KB
- MD5
  
  ed380a4338d439ca09a6e375501a72c8
- SHA1
  
  11b4d0d7a4fc1294c4a26a12f491f1019c9b9c17
- SHA256
  
  fd778cd2f02d549347df0cae2f1a55cfc2d6f73e975d8b88489d04d2447f7ebc
- SHA512
  
  2e1a7c539ee1386141da7954de7e090e70018140c143dcc039c9463738a7893a45a657655ee81d0791624344c3bc36112e0df93503ab0d9f477a8879c37d2ae2
Score

10^/10

gozi_rm3 86920234 banker trojan persistence
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm386920234bankertrojan

behavioral2

gozi_rm386920234bankerpersistencetrojan