Overview

overview

10

Static

static

XqBTvE.exe

windows7_x64

10

XqBTvE.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    XqBTvE.ntwgj
  • Size 252KB
  • Sample220315-mfdacacaak
  • SHA256 ea10f282be1864ccfe204fcba69fea1b172213a5dc114ef46c629a1ea98c8c24
  • MD5 SHA1 SHA512
Score
10/10
gozi_rm3bankertrojan

Malware Config

Extracted

Family

  • gozi_rm3

Attributes
  • build

    300994

Targets

    • Target
      XqBTvE.ntwgj
    • Size 252KB
    • SHA256 ea10f282be1864ccfe204fcba69fea1b172213a5dc114ef46c629a1ea98c8c24
    • MD5 SHA1 SHA512
    Score
    10/10
    gozi_rm3bankertrojan

    • Gozi RM3

      A heavily modified version of Gozi using RM3 loader.

      bankertrojangozi_rm3

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks