General

  • Target

    b64n.txt

  • Size

    257KB

  • Sample

    210910-shq7waace3

  • MD5

    f49074ddc37710861d7832476ba23e6c

  • SHA1

    fa898edbd183fe50c582e4dd278aff0735c3c5ff

  • SHA256

    ff575a3ae768fff422e4945ba5eae5fd779566ac9c708ff52c40280a0b9b26b0

  • SHA512

    b3d648060115b236530c9cac5520b7f9e265b17c7a8fc108596fde6c207a1026e2c2da4aa68fa9efe28b69cc449864a8992c17a3eb94f25cc031564a483d68bb

Malware Config

Extracted

Family

gootkit

Botnet

777

C2

madregobilsg.com

kerymarynicegross.com

pillygreamstronh.com

charnchiumbong.com

kiwimujirahdron.com

Attributes
  • vendor_id

    777

Targets

    • Target

      b64n.txt

    • Size

      257KB

    • MD5

      f49074ddc37710861d7832476ba23e6c

    • SHA1

      fa898edbd183fe50c582e4dd278aff0735c3c5ff

    • SHA256

      ff575a3ae768fff422e4945ba5eae5fd779566ac9c708ff52c40280a0b9b26b0

    • SHA512

      b3d648060115b236530c9cac5520b7f9e265b17c7a8fc108596fde6c207a1026e2c2da4aa68fa9efe28b69cc449864a8992c17a3eb94f25cc031564a483d68bb

    • Gootkit

      Gootkit is a banking trojan, where large parts are written in node.JS.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v6

Tasks