Description
A heavily modified version of Gozi using RM3 loader.
26abb23658a1829ab32e9571659eb160043e35e0100124c5c612e8e31e81cfb4
General
Target
Size
Sample
26abb23658a1829ab32e9571659eb160043e35e0100124c5c612e8e31e81cfb4
909KB
220520-hkxsbseef2
Score
10 /10
MD5
SHA1
SHA256
SHA512
b05e538afe8cb9d55f0e61720626310c
c3154048ac74ceac75fdc62820ef66f1bdb31334
26abb23658a1829ab32e9571659eb160043e35e0100124c5c612e8e31e81cfb4
c668ab5c2686c84c329948c2bf72b7e1c20ea81e3a3706367655cdbb8f67c3d724b82a29252e5fc9c498c664338d370366df95cc806e58fc7738320962ca166c
Malware Config
Extracted
| Family | gozi_rm3 |
| Attributes |
build 300854 |
Extracted
| Family | gozi_rm3 |
| Botnet | 202004141 |
| C2 |
https://devicelease.xyz |
| Attributes |
build 300854
dga_base_url constitution.org/usdeclar.txt
dga_crc 0x4eb7d2ca
dga_season 10
dga_tlds com ru org
exe_type loader
server_id 12
url_path index.htm |
| rsa_pubkey.plain |
|
| serpent.plain |
|
Targets
Target
MD5
Filesize
26abb23658a1829ab32e9571659eb160043e35e0100124c5c612e8e31e81cfb4
b05e538afe8cb9d55f0e61720626310c
909KB
Score
10/10
SHA1
SHA256
SHA512
c3154048ac74ceac75fdc62820ef66f1bdb31334
26abb23658a1829ab32e9571659eb160043e35e0100124c5c612e8e31e81cfb4
c668ab5c2686c84c329948c2bf72b7e1c20ea81e3a3706367655cdbb8f67c3d724b82a29252e5fc9c498c664338d370366df95cc806e58fc7738320962ca166c
Tags
Signatures
-
Gozi RM3
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks