Overview

overview

10

Static

static

9

0e2b1eaae6...26.exe

windows7_x64

10

0e2b1eaae6...26.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e2b1eaae639a24ebd838f58a0afead410bccdd845993a398fe26a5f93466026

  • Size

    72KB

  • Sample

    220524-2vvv9segck

  • MD5

    03832c922e349f3ff3a6eaba817b35f9

  • SHA1

    f8721e7e5b227e8cc1711dbb6164ddca9e781308

  • SHA256

    0e2b1eaae639a24ebd838f58a0afead410bccdd845993a398fe26a5f93466026

  • SHA512

    8ae26acc6a92712e3854d23f938672ecfdf30e93f62eee9f4ae4e351ce38c6176654fd145731cb510bf551f0e370be171f69d3e65b22b18af89473bd42666ab9

Score
10/10
gozi_rm3202004013bankercryptonepackertrojan

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300854

Extracted

Family

gozi_rm3

Botnet

202004013

C2

https://daylightlights.xyz

Attributes
  • build

    300854

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      0e2b1eaae639a24ebd838f58a0afead410bccdd845993a398fe26a5f93466026

    • Size

      72KB

    • MD5

      03832c922e349f3ff3a6eaba817b35f9

    • SHA1

      f8721e7e5b227e8cc1711dbb6164ddca9e781308

    • SHA256

      0e2b1eaae639a24ebd838f58a0afead410bccdd845993a398fe26a5f93466026

    • SHA512

      8ae26acc6a92712e3854d23f938672ecfdf30e93f62eee9f4ae4e351ce38c6176654fd145731cb510bf551f0e370be171f69d3e65b22b18af89473bd42666ab9

    Score
    10/10
    gozi_rm3202004013bankertrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks