gootkit | 43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d

Analysis

Target

43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe
Size

97KB
MD5

3be315046348568a36b8976f64ce7297
SHA1

96f95f161f01926928dec5560a5a1c5094e4e6a2
SHA256

43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d
SHA512

d5857f4aa8ddf34334de82f182065a1cb80fc0f17d75620a3677aa6225b3024cf1472fab23ac8f88b0096336dd0845bdfe36270c49ade99d124585a133b5f74a

Score

10^/10

Family

gootkit

Botnet

1001

pell-talak.com

gudsline.com

Attributes

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit
suricata: ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)
suricata: ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)
suricata

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1972	800	43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe	28
PID 800 wrote to memory of 1972	800	43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe	28
PID 800 wrote to memory of 1972	800	43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe	28
PID 800 wrote to memory of 1972	800	43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe	28

C:\Users\Admin\AppData\Local\Temp\43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe
"C:\Users\Admin\AppData\Local\Temp\43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe
  "C:\Users\Admin\AppData\Local\Temp\43509f678cd6d6f3ea2d6a8fb86ffbd7b7bca5ee8d4a14be763770769417de5d.exe" kdiftogrmlwxnlarcawr
  2⤵
  PID:1972

memory/800-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/800-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/800-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1972-61-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/1972-62-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download