gozi_rm3 | aa35cfbc8854b02c67f80afafbfade075b8b2dfed94a26dcb29ed842b859b4e1 | Triage

Sharing

General

Target

aa35cfbc8854b02c67f80afafbfade075b8b2dfed94a26dcb29ed842b859b4e1
Size

908KB
Sample

220521-app92saeh6
MD5

8989c1ad7e71ceaf21d6d02463719bfc
SHA1

65c628533a6b45cdf0335cc2031f428540e13976
SHA256

aa35cfbc8854b02c67f80afafbfade075b8b2dfed94a26dcb29ed842b859b4e1
SHA512

b390e0641ad974af861fdaa25bb5626ef1c6a708f25869154a4493fa56fadd20f8ca55c4a0cb328c4a9aea7a8e6819c226230e43e80bdf27ab5cb548fc6b0036

Score

10^/10

gozi_rm3 202004141 banker cryptone packer trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes

build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  aa35cfbc8854b02c67f80afafbfade075b8b2dfed94a26dcb29ed842b859b4e1
- Size
  
  908KB
- MD5
  
  8989c1ad7e71ceaf21d6d02463719bfc
- SHA1
  
  65c628533a6b45cdf0335cc2031f428540e13976
- SHA256
  
  aa35cfbc8854b02c67f80afafbfade075b8b2dfed94a26dcb29ed842b859b4e1
- SHA512
  
  b390e0641ad974af861fdaa25bb5626ef1c6a708f25869154a4493fa56fadd20f8ca55c4a0cb328c4a9aea7a8e6819c226230e43e80bdf27ab5cb548fc6b0036
Score

10^/10

gozi_rm3 202004141 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202004141bankertrojan

behavioral2

gozi_rm3202004141bankertrojan