gozi_rm3 | 3cee9438cf696848535ed591297835d289f45b043fae3c303c8f807ced2c0baf | Triage

Sharing

General

Target

3cee9438cf696848535ed591297835d289f45b043fae3c303c8f807ced2c0baf
Size

316KB
Sample

220328-w7hhtahegj
MD5

b14dc264bc83bb3e7ff3e495ea1ddad5
SHA1

225fe42c2340ab348771300b3e3e101e426e7150
SHA256

3cee9438cf696848535ed591297835d289f45b043fae3c303c8f807ced2c0baf
SHA512

2ef247caf0d79e16b95bc51d800169fa1c733c6c6a4b5ce08512654883655af3fb83e50127adc2f616824901da7b92aec2c4c4b3e308cdebd0ff5bd6a419f829

Score

10^/10

gozi_rm3 93020431 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300930
exe_type
loader

Extracted

Family

gozi_rm3

Botnet

93020431

C2

https://onsitenancy.xyz

Attributes

build
300930
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  3cee9438cf696848535ed591297835d289f45b043fae3c303c8f807ced2c0baf
- Size
  
  316KB
- MD5
  
  b14dc264bc83bb3e7ff3e495ea1ddad5
- SHA1
  
  225fe42c2340ab348771300b3e3e101e426e7150
- SHA256
  
  3cee9438cf696848535ed591297835d289f45b043fae3c303c8f807ced2c0baf
- SHA512
  
  2ef247caf0d79e16b95bc51d800169fa1c733c6c6a4b5ce08512654883655af3fb83e50127adc2f616824901da7b92aec2c4c4b3e308cdebd0ff5bd6a419f829
Score

10^/10

gozi_rm3 93020431 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm393020431bankertrojan

behavioral2

gozi_rm393020431bankertrojan