gozi_rm3 | 0bd8d5a3c09ef1d257586099b9fd657806efc157905b2e230999c4ce0ba0cce5 | Triage

Sharing

General

Target

0bd8d5a3c09ef1d257586099b9fd657806efc157905b2e230999c4ce0ba0cce5
Size

462KB
Sample

220524-1vryyaddan
MD5

f725d46afe35141846aa69b94e4e0c9d
SHA1

ada17db1fd4266b5730b1fc693dd9c36661bcb43
SHA256

0bd8d5a3c09ef1d257586099b9fd657806efc157905b2e230999c4ce0ba0cce5
SHA512

49a63c9ee38ae5ee783cdaabb6903843f317fc8ce718345a8e43198d15339f1bd2026fa23aab40981a183650431c764891cba51b4791d3732dd603db8338a8d3

Score

10^/10

gozi_rm3 89820235 banker cryptone packer trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300898

Extracted

Family

gozi_rm3

Botnet

89820235

C2

https://exeupay.xyz

Attributes

build
300898
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  0bd8d5a3c09ef1d257586099b9fd657806efc157905b2e230999c4ce0ba0cce5
- Size
  
  462KB
- MD5
  
  f725d46afe35141846aa69b94e4e0c9d
- SHA1
  
  ada17db1fd4266b5730b1fc693dd9c36661bcb43
- SHA256
  
  0bd8d5a3c09ef1d257586099b9fd657806efc157905b2e230999c4ce0ba0cce5
- SHA512
  
  49a63c9ee38ae5ee783cdaabb6903843f317fc8ce718345a8e43198d15339f1bd2026fa23aab40981a183650431c764891cba51b4791d3732dd603db8338a8d3
Score

10^/10

gozi_rm3 89820235 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm389820235bankertrojan

behavioral2

gozi_rm389820235bankertrojan