gozi_rm3 | 41e52cec2091e4451beadad93c5f693d5a008cf56eaf160f9fa4d577b1d707f6 | Triage

Sharing

General

Target

41e52cec2091e4451beadad93c5f693d5a008cf56eaf160f9fa4d577b1d707f6
Size

42KB
Sample

220201-mkenzacheq
MD5

82484125d69dd4821fc3b0996663b48c
SHA1

167de7e747db000659b41308f5391789f64cabf9
SHA256

41e52cec2091e4451beadad93c5f693d5a008cf56eaf160f9fa4d577b1d707f6
SHA512

c43e7c01451bf618ffa92d9a6101e9e96c475b43bead92cd1076b836e8f77e5db45a8140c71708793c478ebecb3fb890c550ad2e4b7ed39e5e8e47a3a974f89c

Score

10^/10

gozi_rm3 40000 banker persistence trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300854

Extracted

Family

gozi_rm3

Botnet

40000

C2

https://daycareforyou.xyz

Attributes

build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  41e52cec2091e4451beadad93c5f693d5a008cf56eaf160f9fa4d577b1d707f6
- Size
  
  42KB
- MD5
  
  82484125d69dd4821fc3b0996663b48c
- SHA1
  
  167de7e747db000659b41308f5391789f64cabf9
- SHA256
  
  41e52cec2091e4451beadad93c5f693d5a008cf56eaf160f9fa4d577b1d707f6
- SHA512
  
  c43e7c01451bf618ffa92d9a6101e9e96c475b43bead92cd1076b836e8f77e5db45a8140c71708793c478ebecb3fb890c550ad2e4b7ed39e5e8e47a3a974f89c
Score

10^/10

gozi_rm3 40000 banker trojan persistence
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm340000bankertrojan

behavioral2

gozi_rm340000bankerpersistencetrojan