gootkit | 92e2bf4ecdfbc1d16650902698b047e659e7e25ed22665aabfc0b2e22817b679 | Triage

Sharing

General

Target

da05be88c61801cbb45efd78d936f5a3_JaffaCakes118
Size

189KB
Sample

240911-k3x7xssdkl
MD5

da05be88c61801cbb45efd78d936f5a3
SHA1

894389bef866053c2a8610b0593ccec1b17eb275
SHA256

92e2bf4ecdfbc1d16650902698b047e659e7e25ed22665aabfc0b2e22817b679
SHA512

54f522964e44c3654739af9522ac22f8001915846d821eff1d1742273ad1ba94e86e69c65a3c714094b20b5ecd93217888324ba88d5ed8beebe7b1ee0b7dadc0
SSDEEP

3072:tE2MxUfAI2tYVSAljM2APLgJAKOS3RjwqyTYSXUcjdTLZFq19KilslI:t3MxNI2WYew2+UqKOuRMVmcjfFq1Hl

Score

10^/10

gootkit 2855 banker botnet discovery trojan

Malware Config

Extracted

Family

gootkit

Botnet

2855

C2

me.jmitchelldayton.com

otnhmtkwodm1.site

Attributes

vendor_id
2855

Targets

- Target
  
  da05be88c61801cbb45efd78d936f5a3_JaffaCakes118
- Size
  
  189KB
- MD5
  
  da05be88c61801cbb45efd78d936f5a3
- SHA1
  
  894389bef866053c2a8610b0593ccec1b17eb275
- SHA256
  
  92e2bf4ecdfbc1d16650902698b047e659e7e25ed22665aabfc0b2e22817b679
- SHA512
  
  54f522964e44c3654739af9522ac22f8001915846d821eff1d1742273ad1ba94e86e69c65a3c714094b20b5ecd93217888324ba88d5ed8beebe7b1ee0b7dadc0
- SSDEEP
  
  3072:tE2MxUfAI2tYVSAljM2APLgJAKOS3RjwqyTYSXUcjdTLZFq19KilslI:t3MxNI2WYew2+UqKOuRMVmcjfFq1Hl
Score

10^/10

gootkit 2855 banker botnet discovery trojan
- Gootkit
  Gootkit is a banking trojan, where large parts are written in node.JS.
  trojan banker botnet gootkit
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gootkit2855bankerbotnetdiscoverytrojan

behavioral2

gootkit2855bankerbotnetdiscoverytrojan