gozi_rm3 | c6034ba16c31b0b5eafceef7558cb090412f4318a5cff0b8245d5cfcacf1b695 | Triage

Sharing

General

Target

c6034ba16c31b0b5eafceef7558cb090412f4318a5cff0b8245d5cfcacf1b695
Size

619KB
Sample

220520-hjrjxshebr
MD5

831bbbc7f7c583ffde0a582325fdfa49
SHA1

196626ca48871e9f6936e734a2695f2a330ba3d0
SHA256

c6034ba16c31b0b5eafceef7558cb090412f4318a5cff0b8245d5cfcacf1b695
SHA512

bccb0367e1cdfb833dc62fd42880056b6f656019cdd9ef239b3355a6f3cdc2ab423f7b7eecd2c1a8f2dc0e9f10eb470d61f0b870c09bda909094f345a112035e

Score

10^/10

gozi_rm3 90020242 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300900

Extracted

Family

gozi_rm3

Botnet

90020242

C2

https://vrhgroups.xyz

Attributes

build
300900
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  c6034ba16c31b0b5eafceef7558cb090412f4318a5cff0b8245d5cfcacf1b695
- Size
  
  619KB
- MD5
  
  831bbbc7f7c583ffde0a582325fdfa49
- SHA1
  
  196626ca48871e9f6936e734a2695f2a330ba3d0
- SHA256
  
  c6034ba16c31b0b5eafceef7558cb090412f4318a5cff0b8245d5cfcacf1b695
- SHA512
  
  bccb0367e1cdfb833dc62fd42880056b6f656019cdd9ef239b3355a6f3cdc2ab423f7b7eecd2c1a8f2dc0e9f10eb470d61f0b870c09bda909094f345a112035e
Score

10^/10

gozi_rm3 90020242 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm390020242bankertrojan

behavioral2

gozi_rm390020242bankertrojan