gozi_rm3 | 3b9a8922ad981a162ef91d9e3d55ccbbfee1c2c94f76013a14e95fd3104f6af5 | Triage

Sharing

General

Target

3b9a8922ad981a162ef91d9e3d55ccbbfee1c2c94f76013a14e95fd3104f6af5
Size

461KB
Sample

220521-mnczjscag6
MD5

8e6212a958d6d53600b9006cb1177f74
SHA1

8f53ef29fede2024e669f7669d1b9d23f35b4fbd
SHA256

3b9a8922ad981a162ef91d9e3d55ccbbfee1c2c94f76013a14e95fd3104f6af5
SHA512

6fae2047ee9d3693052ee0f35f15abf4328bb750be4f988191fc36dc47ae80285eaaaa536ab2a5f5d2de3476d9dcb842667e813959ec537e5ccae60a150fefb7

Score

10^/10

gozi_rm3 89820235 banker cryptone packer trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300898

Extracted

Family

gozi_rm3

Botnet

89820235

C2

https://exeupay.xyz

Attributes

build
300898
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  3b9a8922ad981a162ef91d9e3d55ccbbfee1c2c94f76013a14e95fd3104f6af5
- Size
  
  461KB
- MD5
  
  8e6212a958d6d53600b9006cb1177f74
- SHA1
  
  8f53ef29fede2024e669f7669d1b9d23f35b4fbd
- SHA256
  
  3b9a8922ad981a162ef91d9e3d55ccbbfee1c2c94f76013a14e95fd3104f6af5
- SHA512
  
  6fae2047ee9d3693052ee0f35f15abf4328bb750be4f988191fc36dc47ae80285eaaaa536ab2a5f5d2de3476d9dcb842667e813959ec537e5ccae60a150fefb7
Score

10^/10

gozi_rm3 89820235 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm389820235bankertrojan

behavioral2

gozi_rm389820235bankertrojan