Overview

overview

10

Static

static

Restr.exe

windows7_x64

10

Restr.exe

windows10-2004_x64

10

Resubmissions

15/03/2022, 08:05

220315-jy3feaahdk10

15/03/2022, 07:24

220315-h8lpzaghf810

Sharing

Copy URL Twitter E-mail

General

  • Target
    Restr.com
  • Size 252KB
  • Sample220315-jy3feaahdk
  • SHA256 0f4395c5cdee1c9fe28ef9a63355594f0f7a23aa41e52b8085a0bda8715da13f
  • MD5 SHA1 SHA512
Score
10/10
gozi_rm3bankertrojan

Malware Config

Extracted

Family

  • gozi_rm3

Attributes
  • build

    300994

rsa_pubkey.plain

Targets

    • Target
      Restr.com
    • Size 252KB
    • SHA256 0f4395c5cdee1c9fe28ef9a63355594f0f7a23aa41e52b8085a0bda8715da13f
    • MD5 SHA1 SHA512
    Score
    10/10
    gozi_rm3bankertrojan

    • Gozi RM3

      A heavily modified version of Gozi using RM3 loader.

      bankertrojangozi_rm3

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Deletes itself

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks