Description
A heavily modified version of Gozi using RM3 loader.
294964a6ada477bb65e8c8eb4a38913b544bc39f49f190013594a8f8d8e22813
General
Target
Size
Sample
294964a6ada477bb65e8c8eb4a38913b544bc39f49f190013594a8f8d8e22813
908KB
220520-hkv9hahefm
Score
10 /10
MD5
SHA1
SHA256
SHA512
12bcc456367fd14ee4304d783d880ee4
c9f00c298983eb122f3fd1030fa8b9ffcc82a68c
294964a6ada477bb65e8c8eb4a38913b544bc39f49f190013594a8f8d8e22813
5dd402606fc5f76f5b869fae21bd6e6434d18cfd2ad5d9f64e5866a327bbc590b03c782351c0c11eb6c4f24fb6174ee095b0d3dfd9cd8481e2b8fc8100712469
Malware Config
Extracted
| Family | gozi_rm3 |
| Attributes |
build 300854 |
Extracted
| Family | gozi_rm3 |
| Botnet | 202004141 |
| C2 |
https://devicelease.xyz |
| Attributes |
build 300854
dga_base_url constitution.org/usdeclar.txt
dga_crc 0x4eb7d2ca
dga_season 10
dga_tlds com ru org
exe_type loader
server_id 12
url_path index.htm |
| rsa_pubkey.plain |
|
| serpent.plain |
|
Targets
Target
MD5
Filesize
294964a6ada477bb65e8c8eb4a38913b544bc39f49f190013594a8f8d8e22813
12bcc456367fd14ee4304d783d880ee4
908KB
Score
10/10
SHA1
SHA256
SHA512
c9f00c298983eb122f3fd1030fa8b9ffcc82a68c
294964a6ada477bb65e8c8eb4a38913b544bc39f49f190013594a8f8d8e22813
5dd402606fc5f76f5b869fae21bd6e6434d18cfd2ad5d9f64e5866a327bbc590b03c782351c0c11eb6c4f24fb6174ee095b0d3dfd9cd8481e2b8fc8100712469
Tags
Signatures
-
Gozi RM3
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks