gootkit | ff575a3ae768fff422e4945ba5eae5fd779566ac9c708ff52c40280a0b9b26b0 | Triage

Sharing

General

Target

exe_stub_final_pe
Size

257KB
Sample

211022-q31wpscfak
MD5

f49074ddc37710861d7832476ba23e6c
SHA1

fa898edbd183fe50c582e4dd278aff0735c3c5ff
SHA256

ff575a3ae768fff422e4945ba5eae5fd779566ac9c708ff52c40280a0b9b26b0
SHA512

b3d648060115b236530c9cac5520b7f9e265b17c7a8fc108596fde6c207a1026e2c2da4aa68fa9efe28b69cc449864a8992c17a3eb94f25cc031564a483d68bb

Score

10^/10

gootkit 777 banker botnet trojan

Malware Config

Extracted

Family

gootkit

Botnet

777

C2

madregobilsg.com

kerymarynicegross.com

pillygreamstronh.com

charnchiumbong.com

kiwimujirahdron.com

Attributes

vendor_id
777

Targets

- Target
  
  exe_stub_final_pe
- Size
  
  257KB
- MD5
  
  f49074ddc37710861d7832476ba23e6c
- SHA1
  
  fa898edbd183fe50c582e4dd278aff0735c3c5ff
- SHA256
  
  ff575a3ae768fff422e4945ba5eae5fd779566ac9c708ff52c40280a0b9b26b0
- SHA512
  
  b3d648060115b236530c9cac5520b7f9e265b17c7a8fc108596fde6c207a1026e2c2da4aa68fa9efe28b69cc449864a8992c17a3eb94f25cc031564a483d68bb
Score

10^/10

gootkit 777 banker botnet trojan
- Gootkit
  Gootkit is a banking trojan, where large parts are written in node.JS.
  trojan banker botnet gootkit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gootkit777bankerbotnettrojan