Overview

overview

10

Static

static

7e7f6dcd58...fc.exe

windows7_x64

10

7e7f6dcd58...fc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7e7f6dcd584900e715876644136425a9b604b851e34763b809c1cfc02c7512fc

  • Size

    618KB

  • Sample

    220525-agmtysgeap

  • MD5

    0619d2d1d582bab0e8153017e8a43144

  • SHA1

    9aa31c2c1982904b5ec804be5a5c05a25a88b470

  • SHA256

    7e7f6dcd584900e715876644136425a9b604b851e34763b809c1cfc02c7512fc

  • SHA512

    2600b2497a21b37e83a39a3ef3abe49440e63ccdd21cb09f1f61f72e158de9b3890581cc53350eae968e0b561e28001a91d2e2574b6994caa19b00df4fee2d76

Score
10/10
gozi_rm390020242bankertrojan

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300900

Extracted

Family

gozi_rm3

Botnet

90020242

C2

https://vrhgroups.xyz

Attributes
  • build

    300900

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      7e7f6dcd584900e715876644136425a9b604b851e34763b809c1cfc02c7512fc

    • Size

      618KB

    • MD5

      0619d2d1d582bab0e8153017e8a43144

    • SHA1

      9aa31c2c1982904b5ec804be5a5c05a25a88b470

    • SHA256

      7e7f6dcd584900e715876644136425a9b604b851e34763b809c1cfc02c7512fc

    • SHA512

      2600b2497a21b37e83a39a3ef3abe49440e63ccdd21cb09f1f61f72e158de9b3890581cc53350eae968e0b561e28001a91d2e2574b6994caa19b00df4fee2d76

    Score
    10/10
    gozi_rm390020242bankertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks