gozi_rm3 | e241136dd38eb7c2889b280d387cc6177423b8ac0fa6671f50c406b34a364186 | Triage

Sharing

General

Target

e241136dd38eb7c2889b280d387cc6177423b8ac0fa6671f50c406b34a364186
Size

908KB
Sample

220525-b9a7asfbb9
MD5

0f7b64349e7e3f3a271a2d77c60506c6
SHA1

4a59af71c183e27e5faf521b86c2a806ecc46b01
SHA256

e241136dd38eb7c2889b280d387cc6177423b8ac0fa6671f50c406b34a364186
SHA512

d62b5dd0c39e78640f94a5a209d678bcc35f1d44c580e2b583ad510dd1850f1296f2c7a172e0b09aea2112f809d7af9dd9e8cde61d40d3aca1838ff84329119c

Score

10^/10

gozi_rm3 202004141 banker cryptone packer trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes

build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  e241136dd38eb7c2889b280d387cc6177423b8ac0fa6671f50c406b34a364186
- Size
  
  908KB
- MD5
  
  0f7b64349e7e3f3a271a2d77c60506c6
- SHA1
  
  4a59af71c183e27e5faf521b86c2a806ecc46b01
- SHA256
  
  e241136dd38eb7c2889b280d387cc6177423b8ac0fa6671f50c406b34a364186
- SHA512
  
  d62b5dd0c39e78640f94a5a209d678bcc35f1d44c580e2b583ad510dd1850f1296f2c7a172e0b09aea2112f809d7af9dd9e8cde61d40d3aca1838ff84329119c
Score

10^/10

gozi_rm3 202004141 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202004141bankertrojan

behavioral2

gozi_rm3202004141bankertrojan