gozi_rm3 | a4bbf7654331415c4f7d0306066ececa014a27d706deca83bd7113ad4cd28d2e | Triage

Sharing

General

Target

a4bbf7654331415c4f7d0306066ececa014a27d706deca83bd7113ad4cd28d2e
Size

291KB
Sample

220201-lj4e9scgh8
MD5

deacce266c9fe2354585347ae32922cc
SHA1

86d4cc7b5b821806c4ef8c9bec71da293fdfd323
SHA256

a4bbf7654331415c4f7d0306066ececa014a27d706deca83bd7113ad4cd28d2e
SHA512

3ef1793f98cce22d7e3d6743d718a19341b31a0a6d5ee18ebce4efa71f5d5c8c1a036a7e4706a5e9a4688d9abc553262003a1bf385d551ba596d6db917680d31

Score

10^/10

gozi_rm3 202003111 banker persistence trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300854

Extracted

Family

gozi_rm3

Botnet

202003111

C2

https://kolamana.com

Attributes

build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  a4bbf7654331415c4f7d0306066ececa014a27d706deca83bd7113ad4cd28d2e
- Size
  
  291KB
- MD5
  
  deacce266c9fe2354585347ae32922cc
- SHA1
  
  86d4cc7b5b821806c4ef8c9bec71da293fdfd323
- SHA256
  
  a4bbf7654331415c4f7d0306066ececa014a27d706deca83bd7113ad4cd28d2e
- SHA512
  
  3ef1793f98cce22d7e3d6743d718a19341b31a0a6d5ee18ebce4efa71f5d5c8c1a036a7e4706a5e9a4688d9abc553262003a1bf385d551ba596d6db917680d31
Score

10^/10

gozi_rm3 202003111 banker trojan persistence
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202003111bankertrojan

behavioral2

gozi_rm3202003111bankerpersistencetrojan