Overview

overview

10

Static

static

9

cd395489a6...be.exe

windows7_x64

10

cd395489a6...be.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd395489a6a7908d910fde8b4b214a19d0d153ba3917ca8a739678a25bb287be

  • Size

    908KB

  • Sample

    220525-adzz4sgdcq

  • MD5

    f19473ae02b129bef80184c3d0ee7ae1

  • SHA1

    e92d50f7f36a8c60917943935b7399b4acd00d66

  • SHA256

    cd395489a6a7908d910fde8b4b214a19d0d153ba3917ca8a739678a25bb287be

  • SHA512

    517c3cd9a621fb589a8610943302170058ddea01896a54451e16aae95fe6cafbd3304732279f993a22a98b98662e9463ba9d9b129a0d719dc189e0edac8e5ca8

Score
10/10
gozi_rm3202004141bankercryptonepackertrojan

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes
  • build

    300854

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      cd395489a6a7908d910fde8b4b214a19d0d153ba3917ca8a739678a25bb287be

    • Size

      908KB

    • MD5

      f19473ae02b129bef80184c3d0ee7ae1

    • SHA1

      e92d50f7f36a8c60917943935b7399b4acd00d66

    • SHA256

      cd395489a6a7908d910fde8b4b214a19d0d153ba3917ca8a739678a25bb287be

    • SHA512

      517c3cd9a621fb589a8610943302170058ddea01896a54451e16aae95fe6cafbd3304732279f993a22a98b98662e9463ba9d9b129a0d719dc189e0edac8e5ca8

    Score
    10/10
    gozi_rm3202004141bankertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks