Overview

overview

10

Static

static

9

1ae1e7c66f...f1.exe

windows7_x64

10

1ae1e7c66f...f1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ae1e7c66ff989ee2351dfcf2d803f8c22b61fed4b10787e922187b260b95bf1

  • Size

    908KB

  • Sample

    220524-2vr5daegbr

  • MD5

    aaf35e23b547415762fa5e88931f78a0

  • SHA1

    b848e4066a700874842b209ec4a0fc68e77dc3d9

  • SHA256

    1ae1e7c66ff989ee2351dfcf2d803f8c22b61fed4b10787e922187b260b95bf1

  • SHA512

    ff09a5d8b6ccf191718ee73fcf964f4f82079e50a9bce18533b583b554693a58dac76e7cd9ea48aede92f9033880dde72abb21abfdb7864a9f32b6585263a6d4

Score
10/10
gozi_rm3202004141bankercryptonepackertrojan

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes
  • build

    300854

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      1ae1e7c66ff989ee2351dfcf2d803f8c22b61fed4b10787e922187b260b95bf1

    • Size

      908KB

    • MD5

      aaf35e23b547415762fa5e88931f78a0

    • SHA1

      b848e4066a700874842b209ec4a0fc68e77dc3d9

    • SHA256

      1ae1e7c66ff989ee2351dfcf2d803f8c22b61fed4b10787e922187b260b95bf1

    • SHA512

      ff09a5d8b6ccf191718ee73fcf964f4f82079e50a9bce18533b583b554693a58dac76e7cd9ea48aede92f9033880dde72abb21abfdb7864a9f32b6585263a6d4

    Score
    10/10
    gozi_rm3202004141bankertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks