General

  • Target
    0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00
  • Size 104KB
  • Sample220604-t68bqsbeem
  • SHA256 0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • gootkit

Botnet
  • 1001

C2
  • pell-talak.com

  • gudsline.com

Attributes
  • vendor_id

    1001

Targets

    • Target
      0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00
    • Size 104KB
    • SHA256 0f1d79b7bebfb7bcfab9823392e986f982d869ba36928bd5f3d61af536ec5a00
    • MD5 SHA1 SHA512
    • Gootkit

      Gootkit is a banking trojan, where large parts are written in node.JS.

    • suricata: ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)

      suricata: ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)

MITRE ATT&CK Matrix

Tasks