Overview

overview

10

Static

static

5eb9121d5d...e0.exe

windows7_x64

10

5eb9121d5d...e0.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0
  • Size 229KB
  • Sample210907-s2eyyschb4
  • SHA256 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0
  • MD5 SHA1 SHA512
Score
10/10
gootkit4444bankerbotnettrojan

Malware Config

Extracted

Family

  • gootkit

Botnet

  • 4444

C2

  • secure256bit.at

  • secure2048.at

Attributes
  • vendor_id

    4444

Targets

    • Target
      5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0
    • Size 229KB
    • SHA256 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0
    • MD5 SHA1 SHA512
    Score
    10/10
    gootkit4444bankerbotnettrojan

    • Gootkit

      Gootkit is a banking trojan, where large parts are written in node.JS.

      trojanbankerbotnetgootkit

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks