gozi_rm3 | ea7d4373da7e6566f95a2690b5334b2a0919e301b7b649e7090b06b970325c6a | Triage

Sharing

General

Target

ea7d4373da7e6566f95a2690b5334b2a0919e301b7b649e7090b06b970325c6a
Size

272KB
Sample

220205-kczytshgar
MD5

ee780533b22873a5be86ee8ec6ab4e0b
SHA1

14690eacf6f362b43fbf2863dfcc79ea71f5b1ea
SHA256

ea7d4373da7e6566f95a2690b5334b2a0919e301b7b649e7090b06b970325c6a
SHA512

5b26d5245000a35fe674f596d85b5fe9a0e27f7f902afacb80d0423e916f155e62390e211a898c135691f5d3586c776fb3f34e1abdf62cc85e86ac12c9b796b5

Score

10^/10

gozi_rm3 202004081 banker cryptone packer persistence trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300854

Extracted

Family

gozi_rm3

Botnet

202004081

C2

https://triomigratio.xyz

Attributes

build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  ea7d4373da7e6566f95a2690b5334b2a0919e301b7b649e7090b06b970325c6a
- Size
  
  272KB
- MD5
  
  ee780533b22873a5be86ee8ec6ab4e0b
- SHA1
  
  14690eacf6f362b43fbf2863dfcc79ea71f5b1ea
- SHA256
  
  ea7d4373da7e6566f95a2690b5334b2a0919e301b7b649e7090b06b970325c6a
- SHA512
  
  5b26d5245000a35fe674f596d85b5fe9a0e27f7f902afacb80d0423e916f155e62390e211a898c135691f5d3586c776fb3f34e1abdf62cc85e86ac12c9b796b5
Score

10^/10

gozi_rm3 202004081 banker trojan persistence
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202004081bankertrojan

behavioral2

gozi_rm3202004081bankerpersistencetrojan