gozi_rm3 | 4a5a550c77e5deb41bc3bb448ac4c196ae126ee563a9f9a4dc808d9721184723 | Triage

Sharing

General

Target

4a5a550c77e5deb41bc3bb448ac4c196ae126ee563a9f9a4dc808d9721184723
Size

909KB
Sample

220525-ct4z4sbhak
MD5

04d66d3dcd958d23d1e4b82a910d9bd0
SHA1

aa0b6aa6ea1ec001b722e63f0205997b9840b7af
SHA256

4a5a550c77e5deb41bc3bb448ac4c196ae126ee563a9f9a4dc808d9721184723
SHA512

a668555a0e17b0ae11133c59356d1e0ad5ec74b4ecbdfcaf8aeb2c56f5c810bcec982ab3b7a96ba2b08a53a722bd7ca4464a2754f653bd7a9c4d814e8695dc9e

Score

10^/10

gozi_rm3 202004141 banker cryptone packer trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes

build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Targets

- Target
  
  4a5a550c77e5deb41bc3bb448ac4c196ae126ee563a9f9a4dc808d9721184723
- Size
  
  909KB
- MD5
  
  04d66d3dcd958d23d1e4b82a910d9bd0
- SHA1
  
  aa0b6aa6ea1ec001b722e63f0205997b9840b7af
- SHA256
  
  4a5a550c77e5deb41bc3bb448ac4c196ae126ee563a9f9a4dc808d9721184723
- SHA512
  
  a668555a0e17b0ae11133c59356d1e0ad5ec74b4ecbdfcaf8aeb2c56f5c810bcec982ab3b7a96ba2b08a53a722bd7ca4464a2754f653bd7a9c4d814e8695dc9e
Score

10^/10

gozi_rm3 202004141 banker trojan
- Gozi RM3
  A heavily modified version of Gozi using RM3 loader.
  banker trojan gozi_rm3
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gozi_rm3202004141bankertrojan

behavioral2

gozi_rm3202004141bankertrojan