gozi_rm3 | 76cf0ed8a2554286a643ffc0661f6e422b014644ff1a51ef4825ae8afb7c5375 | Triage

Sharing

General

Target

76cf0ed8a2554286a643ffc0661f6e422b014644ff1a51ef4825ae8afb7c5375
Size

68KB
Sample

220201-l4dekscegr
MD5

eb437ea8590f9ee0f3723d1469a3699a
SHA1

b46845d7d29ebe3a59b5502b490e70320898a01e
SHA256

76cf0ed8a2554286a643ffc0661f6e422b014644ff1a51ef4825ae8afb7c5375
SHA512

92924519780572c2ea1a4eb33b387ea4ca030cbfc734991f1724d5f77e5efa91bd0e1baadc67334ebba3b12a7c80fefcac9f2209c76a0a885aed6a3bf21a1fb9

Score

10^/10

gozi_rm3 2020109324 banker persistence trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300932

Extracted

Family

gozi_rm3

Botnet

2020109324

C2

https://bonderlas.xyz

Attributes

build
300932
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  76cf0ed8a2554286a643ffc0661f6e422b014644ff1a51ef4825ae8afb7c5375
- Size
  
  68KB
- MD5
  
  eb437ea8590f9ee0f3723d1469a3699a
- SHA1
  
  b46845d7d29ebe3a59b5502b490e70320898a01e
- SHA256
  
  76cf0ed8a2554286a643ffc0661f6e422b014644ff1a51ef4825ae8afb7c5375
- SHA512
  
  92924519780572c2ea1a4eb33b387ea4ca030cbfc734991f1724d5f77e5efa91bd0e1baadc67334ebba3b12a7c80fefcac9f2209c76a0a885aed6a3bf21a1fb9
Score

10^/10

gozi_rm3 2020109324 banker trojan persistence
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm32020109324bankertrojan

behavioral2

gozi_rm32020109324bankerpersistencetrojan