gozi_rm3 | 63f17999bad8452d62701d85591a595ba1ed413c06c2c6e5ccbc0e7598980b9a | Triage

Sharing

General

Target

63f17999bad8452d62701d85591a595ba1ed413c06c2c6e5ccbc0e7598980b9a
Size

462KB
Sample

220418-qta9pahfcq
MD5

554fbe14c3734f524c1931ba671c583f
SHA1

09ab106ee4f07ae261be6495649a093a34f02e84
SHA256

63f17999bad8452d62701d85591a595ba1ed413c06c2c6e5ccbc0e7598980b9a
SHA512

604fb6281b4ecc976038dc7687b1f858ea6d10f63218563fdb58d82253633b8b43f1b1a40ebb3d24e8061b457689fba553705af73728a34fbfae703b59cb1b14

Score

10^/10

gozi_rm3 89820235 banker cryptone packer trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300898

Extracted

Family

gozi_rm3

Botnet

89820235

C2

https://exeupay.xyz

Attributes

build
300898
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  63f17999bad8452d62701d85591a595ba1ed413c06c2c6e5ccbc0e7598980b9a
- Size
  
  462KB
- MD5
  
  554fbe14c3734f524c1931ba671c583f
- SHA1
  
  09ab106ee4f07ae261be6495649a093a34f02e84
- SHA256
  
  63f17999bad8452d62701d85591a595ba1ed413c06c2c6e5ccbc0e7598980b9a
- SHA512
  
  604fb6281b4ecc976038dc7687b1f858ea6d10f63218563fdb58d82253633b8b43f1b1a40ebb3d24e8061b457689fba553705af73728a34fbfae703b59cb1b14
Score

10^/10

gozi_rm3 89820235 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm389820235bankertrojan

behavioral2

gozi_rm389820235bankertrojan