gozi_rm3 | 9e87f069de22ceac029a4ac56e6305d2df54227e6b0f0b3ecad52a01fbade021

General

Target

SATURN_RANSOM.bin
Size

338KB
Sample

220430-ylg19sfcdp
MD5

bbd4c2d2c72648c8f871b36261be23fd
SHA1

77c525e6b8a5760823ad6036e60b3fa244db8e42
SHA256

9e87f069de22ceac029a4ac56e6305d2df54227e6b0f0b3ecad52a01fbade021
SHA512

38f2ff3b7ff6faa63ef0a3200e0dbb9e48e1d404a065f6919cb6d245699479896a42316f299c33c8cc068922934c64f8aa06c88b000d1676870c1d0c0f18e14a

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\#DECRYPT_MY_FILES#.txt

Ransom Note

S A T U R N All of your files have been encrypted! To Decrypt your files follow these steps: #---------------------------------------------# 1. Download and install the "Tor Browser" from https://www.torproject.org 2. Run it. 3. In the Tor Browser, open website: http://su34pwhpcafeiztt.onion 4. Follow the instructions on the page #---------------------------------------------#

URLs

http://su34pwhpcafeiztt.onion

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\#DECRYPT_MY_FILES#.html

Ransom Note

<html> <title>S A T U R N</title> <center> <body> <h1>S A T U R N</h1> <h4>Your documents, photos, databases, and other important files have been encrypted!</h4> <br /> To Decrypt your files follow these instructions: <br /> <div> <h4>1. Download and Install Tor Browser from <a href=https://www.torproject.org/>https://www.torproject.org/</a></h4> <br /> <h4>2. Run the browser</h4> <br /> <h4>3. In the Tor Browser, open website:</h3> <div style="background-color: #d9d9d9; margin-left: 20px; margin-right: 20px; padding-bottom: 8px; padding-left: 8px; padding-right: 8px; padding-top: 8px;"> </a><b>http://su34pwhpcafeiztt.onion</b><br/> </div> <h4>4. Follow the instructions at this website</h4> </div> </body> </center> </html> <style> html { background-color: white; font-family: Helvetica, sans-serif; } div { background-color: #f2f2f2; width: 80: %; padding: 25px; margin: 25px; overflow:hidden; } </style>

Targets

- Target
  
  SATURN_RANSOM.bin
- Size
  
  338KB
- MD5
  
  bbd4c2d2c72648c8f871b36261be23fd
- SHA1
  
  77c525e6b8a5760823ad6036e60b3fa244db8e42
- SHA256
  
  9e87f069de22ceac029a4ac56e6305d2df54227e6b0f0b3ecad52a01fbade021
- SHA512
  
  38f2ff3b7ff6faa63ef0a3200e0dbb9e48e1d404a065f6919cb6d245699479896a42316f299c33c8cc068922934c64f8aa06c88b000d1676870c1d0c0f18e14a
Score

10^/10

gozi_rm3 banker evasion ransomware spyware stealer trojan persistence
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
- Registers COM server for autorun
  persistence
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Enumerates VirtualBox registry keys
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2