Banking malware targeting mainly Europe & Oceania But if you would like to understand the rather tortured history of this particular malware a little better, the research and blog posts on the subject by Check Pointare a good starting point.

This is further complicated by the many different names used by the Cyber Threat Intelligence and Anti-Virus industries for this family of malware. Given the complex development history of the Gozi ISFB forks, it is difficult to say with any certainty which variant was used as the basis for RM3.

Used exotic PE file format exclusively designed for this banking malware.In 2017, yet another new version was detected in the wild with a number of major modifications compared to the previous main variant: It is one of the few – perhaps the only – main active branches of the notorious 15 year old Gozi / CRM. Its popularity is probably due to the wide range of variants which are available and the way threat actor groups can use these for their own goals. Gozi ISFB started targeting financial institutions around 2013-2015 and hasn’t stopped since then. These are operated by a variety of threat actors (TAs) and generally cause financial losses by either direct involvement in transactional fraud, or by facilitating other types of malicious activity, such as targeted ransomware activity. Since September 2019, Fox-IT/NCC Group has intensified its research into known active Gozi variants. Introductionĭespite its long and rich history in the cyber-criminal underworld, the Gozi malware family is surrounded with mystery and confusion. The leaking of its source code only increased this confusion as it led to an influx of Gozi variants across the threat landscape.Īlthough most variants were only short-lived – they either disappeared or were taken down by law enforcement – a few have had greater staying power. We’ll start with an overview of its origins and current operations before providing a deep dive technical analysis of the RM3 variant. In this post we provide some history, analysis and observations on this most pernicious family of banking malware targeting Oceania, the UK, Germany and Italy.

Our Research and Intelligence Fusion Team have been tracking the Gozi variant RM3 for close to 30 months.

Malwarefox portable