gozi_rm3 | 9a2af70fd4fe7a3db607473704bd832702dee6d38c689f501dc7f259cafe9dfe | Triage

Sharing

General

Target

9a2af70fd4fe7a3db607473704bd832702dee6d38c689f501dc7f259cafe9dfe
Size

908KB
Sample

220524-2t99kaagh3
MD5

ef36c1995c98698809f5cadce4042973
SHA1

d9dc75172c2f27d32a3b79deed9becc81c640d2a
SHA256

9a2af70fd4fe7a3db607473704bd832702dee6d38c689f501dc7f259cafe9dfe
SHA512

40b98c34a1356d41ab01042a41662f842020913256be5ea65fd165bae954f824322d646a658dd4dba3624230f6ea9fb0f5576fff5d3228eef72463c1a82e3b1e

Score

10^/10

gozi_rm3 202004141 banker cryptone packer trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes

build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  9a2af70fd4fe7a3db607473704bd832702dee6d38c689f501dc7f259cafe9dfe
- Size
  
  908KB
- MD5
  
  ef36c1995c98698809f5cadce4042973
- SHA1
  
  d9dc75172c2f27d32a3b79deed9becc81c640d2a
- SHA256
  
  9a2af70fd4fe7a3db607473704bd832702dee6d38c689f501dc7f259cafe9dfe
- SHA512
  
  40b98c34a1356d41ab01042a41662f842020913256be5ea65fd165bae954f824322d646a658dd4dba3624230f6ea9fb0f5576fff5d3228eef72463c1a82e3b1e
Score

10^/10

gozi_rm3 202004141 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202004141bankertrojan

behavioral2

gozi_rm3202004141bankertrojan