Overview

overview

10

Static

static

9

b8a5668379...0e.exe

windows7_x64

10

b8a5668379...0e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8a5668379a1243ed7343ccfaa62fc47e6fee8e699256d854c4a54751475710e

  • Size

    908KB

  • Sample

    220524-1n9v6shbf7

  • MD5

    bd1a97b75535f712379629845b7d5216

  • SHA1

    174060eaa511830ef534d4706b22fae11c274fcc

  • SHA256

    b8a5668379a1243ed7343ccfaa62fc47e6fee8e699256d854c4a54751475710e

  • SHA512

    83720eb7cfb13884ac8dcd799cbedf224e33d403972cce41d8aafda8446ccbe8006c3f7870abb820673cac42cf038829f1cd40a7a1a99c9e82e16c86641689e0

Score
10/10
gozi_rm3202004141bankercryptonepackertrojan

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes
  • build

    300854

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      b8a5668379a1243ed7343ccfaa62fc47e6fee8e699256d854c4a54751475710e

    • Size

      908KB

    • MD5

      bd1a97b75535f712379629845b7d5216

    • SHA1

      174060eaa511830ef534d4706b22fae11c274fcc

    • SHA256

      b8a5668379a1243ed7343ccfaa62fc47e6fee8e699256d854c4a54751475710e

    • SHA512

      83720eb7cfb13884ac8dcd799cbedf224e33d403972cce41d8aafda8446ccbe8006c3f7870abb820673cac42cf038829f1cd40a7a1a99c9e82e16c86641689e0

    Score
    10/10
    gozi_rm3202004141bankertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks