General

  • Target

    3ce1a0b8cf3bee00089a91c662f0a0e7d9ac4d1e0c3984df55163f88c864ea0a

  • Size

    908KB

  • Sample

    220525-crkhpabgbn

  • MD5

    fa4108c7d2f3513bc69ba5a2dc5442ee

  • SHA1

    5568156adac734cc6a3d7e02fb63fba222363284

  • SHA256

    3ce1a0b8cf3bee00089a91c662f0a0e7d9ac4d1e0c3984df55163f88c864ea0a

  • SHA512

    e9876aacdb627c18811a43ae8ddec67e2c05f974385cf6c6527366fc18ab4f7d3523a97c0f4c06ea5a0a7b6f33503552c94a556516fe24fde15984e6b08e0a4f

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes
  • build

    300854

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      3ce1a0b8cf3bee00089a91c662f0a0e7d9ac4d1e0c3984df55163f88c864ea0a

    • Size

      908KB

    • MD5

      fa4108c7d2f3513bc69ba5a2dc5442ee

    • SHA1

      5568156adac734cc6a3d7e02fb63fba222363284

    • SHA256

      3ce1a0b8cf3bee00089a91c662f0a0e7d9ac4d1e0c3984df55163f88c864ea0a

    • SHA512

      e9876aacdb627c18811a43ae8ddec67e2c05f974385cf6c6527366fc18ab4f7d3523a97c0f4c06ea5a0a7b6f33503552c94a556516fe24fde15984e6b08e0a4f

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Tasks