Overview

overview

10

Static

static

crypted_lo..._5.dll

windows7_x64

10

crypted_lo..._5.dll

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    crypted_loader_dll_64Donat_5.dll
  • Size 151KB
  • Sample220407-sa1rcaefen
  • SHA256 41ae907a2bb73794bb2cff40b429e62305847a3e1a95f188b596f1cf925c4547
  • MD5 SHA1 SHA512
Score
10/10
gozi_rm3bankertrojan

Malware Config

Extracted

Family

  • gozi_rm3

Attributes
  • build

    300994

rsa_pubkey.base64
rsa_pubkey.plain

Targets

    • Target
      crypted_loader_dll_64Donat_5.dll
    • Size 151KB
    • SHA256 41ae907a2bb73794bb2cff40b429e62305847a3e1a95f188b596f1cf925c4547
    • MD5 SHA1 SHA512
    Score
    10/10
    gozi_rm3bankertrojan

    • Gozi RM3

      A heavily modified version of Gozi using RM3 loader.

      bankertrojangozi_rm3

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks