gozi_rm3 | 5654000269026d84de04c6844f4b04c59a0e33a8f735f68dcc38c42e35fd208c | Triage

Sharing

General

Target

5654000269026d84de04c6844f4b04c59a0e33a8f735f68dcc38c42e35fd208c
Size

36KB
Sample

220201-md5xkscger
MD5

fc214ac85663dd6d34e265efce936002
SHA1

c6e24cbb6df3b37145743a8d4d44ce3898ebe8bc
SHA256

5654000269026d84de04c6844f4b04c59a0e33a8f735f68dcc38c42e35fd208c
SHA512

d01be850fdd808be903d5c14c92ce6dd8c9c483123ab3c1a4c1348f4d21fadb3bcf5585a6e91b70cfc3f8cd1c434c433be64bf48237bc872016d778deff167f5

Score

10^/10

gozi_rm3 banker persistence trojan

Malware Config

Targets

- Target
  
  5654000269026d84de04c6844f4b04c59a0e33a8f735f68dcc38c42e35fd208c
- Size
  
  36KB
- MD5
  
  fc214ac85663dd6d34e265efce936002
- SHA1
  
  c6e24cbb6df3b37145743a8d4d44ce3898ebe8bc
- SHA256
  
  5654000269026d84de04c6844f4b04c59a0e33a8f735f68dcc38c42e35fd208c
- SHA512
  
  d01be850fdd808be903d5c14c92ce6dd8c9c483123ab3c1a4c1348f4d21fadb3bcf5585a6e91b70cfc3f8cd1c434c433be64bf48237bc872016d778deff167f5
Score

10^/10

gozi_rm3 banker trojan persistence
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3bankertrojan

behavioral2

gozi_rm3bankerpersistencetrojan