gozi_rm3 | 8cc40736f20576ad37823787052fbe786daf4b5fd332aa2779f41cc1ef0c94cb | Triage

Sharing

General

Target

8cc40736f20576ad37823787052fbe786daf4b5fd332aa2779f41cc1ef0c94cb
Size

52KB
Sample

220201-lwacyscdgq
MD5

dfe7178a313f4277e728b1a8cd96fa29
SHA1

c8850277f2d2b5cba8a59820cbad1c27c8873365
SHA256

8cc40736f20576ad37823787052fbe786daf4b5fd332aa2779f41cc1ef0c94cb
SHA512

9b39e95b948528e79dd44f620e761e3b668a67755a2c1ca9a5d51973ab90191ecc6dcd805b95d115920b80c91fc27a7aa84f2bc7fe52722bfd7b9d7476ae6cd5

Score

10^/10

gozi_rm3 202105141 banker persistence trojan

Malware Config

Extracted

Family

gozi_rm3

Botnet

202105141

C2

https://robonight.xyz

Attributes

build
300968
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  8cc40736f20576ad37823787052fbe786daf4b5fd332aa2779f41cc1ef0c94cb
- Size
  
  52KB
- MD5
  
  dfe7178a313f4277e728b1a8cd96fa29
- SHA1
  
  c8850277f2d2b5cba8a59820cbad1c27c8873365
- SHA256
  
  8cc40736f20576ad37823787052fbe786daf4b5fd332aa2779f41cc1ef0c94cb
- SHA512
  
  9b39e95b948528e79dd44f620e761e3b668a67755a2c1ca9a5d51973ab90191ecc6dcd805b95d115920b80c91fc27a7aa84f2bc7fe52722bfd7b9d7476ae6cd5
Score

10^/10

gozi_rm3 202105141 banker trojan persistence
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202105141bankertrojan

behavioral2

gozi_rm3202105141bankerpersistencetrojan