Overview

overview

10

Static

static

10

9e38261333...a6.exe

windows7_x64

1

9e38261333...a6.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9e38261333e7b21ef5cb12865195a82eab273711d1000ecac8596168b62b0ba6
  • Size 68KB
  • Sample220201-llppwschb4
  • SHA256 9e38261333e7b21ef5cb12865195a82eab273711d1000ecac8596168b62b0ba6
  • MD5 SHA1 SHA512
Score
10/10
gozi_rm3persistence

Malware Config

Extracted

Family

  • gozi_rm3

Attributes
  • build

    300814

Targets

    • Target
      9e38261333e7b21ef5cb12865195a82eab273711d1000ecac8596168b62b0ba6
    • Size 68KB
    • SHA256 9e38261333e7b21ef5cb12865195a82eab273711d1000ecac8596168b62b0ba6
    • MD5 SHA1 SHA512
    Score
    10/10
    persistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks