gozi_rm3 | a6b6bf5d8f38446e086c8ec207cfbac2cca6de961a748e6cd72b0d6a40cd538a | Triage

Sharing

General

Target

a6b6bf5d8f38446e086c8ec207cfbac2cca6de961a748e6cd72b0d6a40cd538a
Size

619KB
Sample

220520-1cnhssghfj
MD5

81e01aceb4714cae6a95a8308749b1fc
SHA1

62f1099cd937aa7f15fea262694e8a43a7f8b798
SHA256

a6b6bf5d8f38446e086c8ec207cfbac2cca6de961a748e6cd72b0d6a40cd538a
SHA512

6f9517707a7fc96876dd7d828fe560fda3fd5b6677b9e0a95d40d479c3dd35998e34922ff18143e607319625359fae093f7e51be31378920bd2a5bf1f8149cab

Score

10^/10

gozi_rm3 90020242 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300900

Extracted

Family

gozi_rm3

Botnet

90020242

C2

https://vrhgroups.xyz

Attributes

build
300900
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  a6b6bf5d8f38446e086c8ec207cfbac2cca6de961a748e6cd72b0d6a40cd538a
- Size
  
  619KB
- MD5
  
  81e01aceb4714cae6a95a8308749b1fc
- SHA1
  
  62f1099cd937aa7f15fea262694e8a43a7f8b798
- SHA256
  
  a6b6bf5d8f38446e086c8ec207cfbac2cca6de961a748e6cd72b0d6a40cd538a
- SHA512
  
  6f9517707a7fc96876dd7d828fe560fda3fd5b6677b9e0a95d40d479c3dd35998e34922ff18143e607319625359fae093f7e51be31378920bd2a5bf1f8149cab
Score

10^/10

gozi_rm3 90020242 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm390020242bankertrojan

behavioral2

gozi_rm390020242bankertrojan