Overview

overview

10

Static

static

f1b2446558...3e.exe

windows7-x64

10

f1b2446558...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1b2446558e35df613366ca1bff2e0120113e21aa593c4f1f449f1e554d1dc3e

  • Size

    286KB

  • Sample

    230129-wacajahc3t

  • MD5

    2ea0561bb3cdae9cf682703de2933a43

  • SHA1

    827696cf98926dea8bfde038de228b7778d0ff56

  • SHA256

    f1b2446558e35df613366ca1bff2e0120113e21aa593c4f1f449f1e554d1dc3e

  • SHA512

    e6fac7e489e967cb2174016e3236b0acfe60625b8286bc35dd35c0c5cd5716b284891f68033b05b211380dd135aabd93ff25e18ed8ddeb0c536e29bbc7f92cdb

  • SSDEEP

    6144:FBeVV56G+JCBe35SVPilxd50wX2n9RzozaFCu6/u3W:FBgVNPwdR2oOkuku3W

Score
10/10
gootkit6546bankerbotnettrojan

Malware Config

Extracted

Family

gootkit

Botnet

6546

C2

servicemanager.icu

partnerservice.xyz
Attributes
  • vendor_id

    6546

Targets

    • Target

      f1b2446558e35df613366ca1bff2e0120113e21aa593c4f1f449f1e554d1dc3e

    • Size

      286KB

    • MD5

      2ea0561bb3cdae9cf682703de2933a43

    • SHA1

      827696cf98926dea8bfde038de228b7778d0ff56

    • SHA256

      f1b2446558e35df613366ca1bff2e0120113e21aa593c4f1f449f1e554d1dc3e

    • SHA512

      e6fac7e489e967cb2174016e3236b0acfe60625b8286bc35dd35c0c5cd5716b284891f68033b05b211380dd135aabd93ff25e18ed8ddeb0c536e29bbc7f92cdb

    • SSDEEP

      6144:FBeVV56G+JCBe35SVPilxd50wX2n9RzozaFCu6/u3W:FBgVNPwdR2oOkuku3W

    Score
    10/10
    gootkit6546bankerbotnettrojan

    • Gootkit

      Gootkit is a banking trojan, where large parts are written in node.JS.

      trojanbankerbotnetgootkit

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks