Overview

overview

10

Static

static

10

53e4678679...c4.dll

windows7_x64

1

53e4678679...c4.dll

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53e467867988f32cf3b0edf822755ddaa5264aa0e7be5bbaf4728754824219c4

  • Size

    54KB

  • MD5

    ba2cb9b75781ede9afab78924ab7a016

  • SHA1

    cd781d469a0f8f52dcef5f75072c16b970e0e31e

  • SHA256

    53e467867988f32cf3b0edf822755ddaa5264aa0e7be5bbaf4728754824219c4

  • SHA512

    d0174240d9d396fdc8a3066959f569c830f7ef3915d33ad74491dfa1b78f23f155f73f23b71bf94f0dd5ad9d712e8530d434dee059c4d877ee01b40cc9951110

  • SSDEEP

    1536:/dPXKZ+D9GwRCQc19qW7oKsLID2p+WyMp/O/cO:lPaZ+IwRCnuKsLID++WyMpm/c

Score
10/10
201910301gozi_rm3

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • exe_type

    loader

Extracted

Family

gozi_rm3

Botnet

201910301

C2

https://jamesdrywall.xyz

Attributes
  • build

    300794

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi_rm3 family
    gozi_rm3
  • Ursnif RM3 loader 1 IoCs

    Detected the Ursnif RM3 loader, which is a heavily modified version of the Ursnif one.

Files

  • 53e467867988f32cf3b0edf822755ddaa5264aa0e7be5bbaf4728754824219c4
    .dll windows x86

    cdd0f2154e32ed5e0b51734142b86fcd


    Code Sign

    Headers

    Imports

    Sections