General

  • Target
    43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d
  • Size 97KB
  • Sample220707-3am6csaaf9
  • SHA256 43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • gootkit

Botnet
  • 1001

C2
  • pell-talak.com

  • gudsline.com

Attributes
  • vendor_id

    1001

Targets

    • Target
      43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d
    • Size 97KB
    • SHA256 43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d
    • MD5 SHA1 SHA512
    • Gootkit

      Gootkit is a banking trojan, where large parts are written in node.JS.

    • suricata: ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)

      suricata: ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)

MITRE ATT&CK Matrix

Tasks