gozi_rm3 | eecd9a9813b954f7daf54b1e0bc34fb46c6b13cf2aa2f3051975548943682468 | Triage

Sharing

General

Target

eecd9a9813b954f7daf54b1e0bc34fb46c6b13cf2aa2f3051975548943682468
Size

54KB
Sample

220201-ksb7psbgbl
MD5

bb3535a7fee8107ad7959ab3a38d094d
SHA1

a78c92551414444bb65b5fbb54079c17a8287a38
SHA256

eecd9a9813b954f7daf54b1e0bc34fb46c6b13cf2aa2f3051975548943682468
SHA512

0faabc86a43952cd300fb2380a4673f379c1ec36200a550cb1a550244087ced01138594491aeb48c870b4754d7205648fb19b2cbfbab9a8224ea98437e6d4e27

Score

10^/10

gozi_rm3 913101 banker persistence trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300913

Extracted

Family

gozi_rm3

Botnet

913101

C2

https://veraensue.xyz

Attributes

build
300913
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  eecd9a9813b954f7daf54b1e0bc34fb46c6b13cf2aa2f3051975548943682468
- Size
  
  54KB
- MD5
  
  bb3535a7fee8107ad7959ab3a38d094d
- SHA1
  
  a78c92551414444bb65b5fbb54079c17a8287a38
- SHA256
  
  eecd9a9813b954f7daf54b1e0bc34fb46c6b13cf2aa2f3051975548943682468
- SHA512
  
  0faabc86a43952cd300fb2380a4673f379c1ec36200a550cb1a550244087ced01138594491aeb48c870b4754d7205648fb19b2cbfbab9a8224ea98437e6d4e27
Score

10^/10

gozi_rm3 913101 banker trojan persistence
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3913101bankertrojan

behavioral2

gozi_rm3913101bankerpersistencetrojan