Overview

overview

10

Static

static

e561ae3ced...b0.exe

windows7_x64

10

e561ae3ced...b0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e561ae3cedb6f9fc0ecff559c62788b0

  • Size

    293KB

  • Sample

    210204-5d3bbhwkds

  • MD5

    e561ae3cedb6f9fc0ecff559c62788b0

  • SHA1

    de34eb34e2c489386fb32dd96469e7fdcef617d9

  • SHA256

    38933984f5ff8b71c054d1c1155e308ac02377b89315ef17cea859178a30dbab

  • SHA512

    c3abd85394b75b05b2bb7c53c28e3d1309226294c16594e6704e009f49353c45de4fcf632222f55529916181ce545485d6fd26d14eecb3db91b625ba9730d757

Score
10/10
gootkit8888bankerbotnetransomwaretrojan

Malware Config

Extracted

Family

gootkit

Botnet

8888

C2

sslsecurehost.com

securessl256.com
Attributes
  • vendor_id

    8888

Targets

    • Target

      e561ae3cedb6f9fc0ecff559c62788b0

    • Size

      293KB

    • MD5

      e561ae3cedb6f9fc0ecff559c62788b0

    • SHA1

      de34eb34e2c489386fb32dd96469e7fdcef617d9

    • SHA256

      38933984f5ff8b71c054d1c1155e308ac02377b89315ef17cea859178a30dbab

    • SHA512

      c3abd85394b75b05b2bb7c53c28e3d1309226294c16594e6704e009f49353c45de4fcf632222f55529916181ce545485d6fd26d14eecb3db91b625ba9730d757

    Score
    10/10
    gootkit8888bankerbotnetransomwaretrojan

    • Gootkit

      Gootkit is a banking trojan, where large parts are written in node.JS.

      trojanbankerbotnetgootkit

    • Deletes itself

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks