gozi_rm3 | afb54296eddcc65d4ec2d884cdbde8bcce4f3f1d1c026dc1072927f10fe9046a | Triage

Sharing

General

Target

afb54296eddcc65d4ec2d884cdbde8bcce4f3f1d1c026dc1072927f10fe9046a
Size

908KB
Sample

220520-hjwtmseec2
MD5

612f1a5f3003c638369ed2f4d484a5a6
SHA1

ed9e2bbbb40af4140ef8b15b243bacd30b7ef61f
SHA256

afb54296eddcc65d4ec2d884cdbde8bcce4f3f1d1c026dc1072927f10fe9046a
SHA512

8b9291ea5b22c7489c072fdad6787e518895f2716e213dbc99e82669d8f7879af9a90d0fc1953392ebfafc668860f4d86503e1cb7d32960c8cce74be5e7bca2a

Score

10^/10

gozi_rm3 202004141 banker cryptone packer trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes

build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  afb54296eddcc65d4ec2d884cdbde8bcce4f3f1d1c026dc1072927f10fe9046a
- Size
  
  908KB
- MD5
  
  612f1a5f3003c638369ed2f4d484a5a6
- SHA1
  
  ed9e2bbbb40af4140ef8b15b243bacd30b7ef61f
- SHA256
  
  afb54296eddcc65d4ec2d884cdbde8bcce4f3f1d1c026dc1072927f10fe9046a
- SHA512
  
  8b9291ea5b22c7489c072fdad6787e518895f2716e213dbc99e82669d8f7879af9a90d0fc1953392ebfafc668860f4d86503e1cb7d32960c8cce74be5e7bca2a
Score

10^/10

gozi_rm3 202004141 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gozi_rm3202004141bankertrojan

behavioral2

gozi_rm3202004141bankertrojan