Extracted

• • Target
    e561ae3cedb6f9fc0ecff559c62788b0
  • Size 293KB
  • SHA256 38933984f5ff8b71c054d1c1155e308ac02377b89315ef17cea859178a30dbab
  • MD5 e561ae3cedb6f9fc0ecff559c62788b0
  • SHA1 de34eb34e2c489386fb32dd96469e7fdcef617d9
  • SHA512 c3abd85394b75b05b2bb7c53c28e3d1309226294c16594e6704e009f49353c45de4fcf632222f55529916181ce545485d6fd26d14eecb3db91b625ba9730d757
  • MD5 SHA1 SHA512

  Score

  10^/10

  gootkit8888bankerbotnetransomwaretrojan

  • Gootkit

    Gootkit is a banking trojan, where large parts are written in node.JS.

    trojanbankerbotnetgootkit

  • Deletes itself

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2