gootkit | c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f | Triage

Sharing

General

Target

c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f
Size

189KB
Sample

220724-vyjtvacefp
MD5

a5bb21de4e9bf7463f59001bdaf99d30
SHA1

820820f490424b1f4cf4e3d0787b005eaa8e5115
SHA256

c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f
SHA512

7f41b70b57ea81153098ac44a0cf65b0414df10278117f9c234cb3206336ee3e14dce8c3e38610756ecbe4b86f40933906670260b9fb73ea6da21c9dbf9c939e

Score

10^/10

gootkit 2855 banker botnet trojan

Malware Config

Extracted

Family

gootkit

Botnet

2855

C2

me.jmitchelldayton.com

otnhmtkwodm1.site

Attributes

vendor_id
2855

Targets

- Target
  
  c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f
- Size
  
  189KB
- MD5
  
  a5bb21de4e9bf7463f59001bdaf99d30
- SHA1
  
  820820f490424b1f4cf4e3d0787b005eaa8e5115
- SHA256
  
  c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f
- SHA512
  
  7f41b70b57ea81153098ac44a0cf65b0414df10278117f9c234cb3206336ee3e14dce8c3e38610756ecbe4b86f40933906670260b9fb73ea6da21c9dbf9c939e
Score

10^/10

gootkit 2855 banker botnet trojan
- Gootkit
  Gootkit is a banking trojan, where large parts are written in node.JS.
  trojan banker botnet gootkit
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gootkit2855bankerbotnettrojan

behavioral2

gootkit2855bankerbotnettrojan