Overview

overview

10

Static

static

10

68a2b66cd3...87.dll

windows7_x64

1

68a2b66cd3...87.dll

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    68a2b66cd3cf613dc575787660dc444c68ad256cb9264b64c189b230d0f8f287

  • Size

    70KB

  • MD5

    4adc87bc1193e51d12ba19ea89032054

  • SHA1

    69a901e8560dfb1f44c533c52fe01f9981da183a

  • SHA256

    68a2b66cd3cf613dc575787660dc444c68ad256cb9264b64c189b230d0f8f287

  • SHA512

    f82cde15fb6172b08c5a84531bfb5533320940fb2549866171ef7073ee59cb5da30b89f6b7a32314cb9869e4d335c8e817ba322006e7929c8a4320f0d7ea3b32

  • SSDEEP

    1536:XqQc1UOXOPXCbuh9qUWODNTVkj5Lxaq2w2cn4Dnyg6L:6nUOXOPybu+mNTVi552wXnayg6

Score
10/10
201910081gozi_rm3

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • exe_type

    loader

Extracted

Family

gozi_rm3

Botnet

201910081

C2

https://kenneyai.xyz

Attributes
  • build

    300787

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi_rm3 family
    gozi_rm3
  • Ursnif RM3 loader 1 IoCs

    Detected the Ursnif RM3 loader, which is a heavily modified version of the Ursnif one.

Files

  • 68a2b66cd3cf613dc575787660dc444c68ad256cb9264b64c189b230d0f8f287
    .dll windows x86

    a445a7dad8d4af4e2ecce7db38d0d214


    Code Sign

    Headers

    Imports

    Sections