gootkit | 226792baf638fbc82be1396e926e06a6d3570f6f8b5bf14439fee0ee5af5bd9b | Triage™

Login
Reports

Overview

overview

Static

static

3

tmphlbp4jst.exe

windows10-ltsc_2021-x64

tmphlbp4jst.exe

windows10-2004-x64

tmphlbp4jst.exe

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

Target
tmphlbp4jst
Size 187KB
Sample260609-p4cptsbt4j
SHA256 226792baf638fbc82be1396e926e06a6d3570f6f8b5bf14439fee0ee5af5bd9b
MD5 23e26f6748b07db1b464f5d237917282
SHA1 3a27db2d1ac8a8fc30d972f4b9d7f91e99d7f96f
SHA512 53e86805989a7a18964cb44ea514d1728a97931979bdbc991011a5a88fa8a49564f1bffb59ca061666cae37eb020e87c00c9d4361c2c5fb4f696f418e5ca7d53
SSDEEP 3072:/dx2x7BPxWX3U+W67th1KA4D/cihCutl/vUu6T6fBuI2sc:/dx2xaUe7th1uD/cihC61UuSsc
TLSH
T135149D10309164E1C699B63BA45E7FA9CBE5E2123F7374963B3638DF6142BC33279A05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

gootkit 2855 banker botnet discovery trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

tmphlbp4jst.exe

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

5 signatures

150 seconds

banker botnet 2855 discovery gootkit trojan

Behavioral task

behavioral2

Sample

tmphlbp4jst.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

5 signatures

150 seconds

banker botnet 2855 discovery gootkit trojan

Behavioral task

behavioral3

Sample

tmphlbp4jst.exe

Resource

win11-20260513-en

windows11-21h2-x64

5 signatures

150 seconds

banker botnet 2855 discovery gootkit trojan

Malware Config

Extracted

Family

gootkit

Botnet

2855

C2

me.jmitchelldayton.com
otnhmtkwodm1.site

Attributes

vendor_id
2855

Targets

- Target
  tmphlbp4jst
- Size 187KB
- SHA256 226792baf638fbc82be1396e926e06a6d3570f6f8b5bf14439fee0ee5af5bd9b
- MD5 23e26f6748b07db1b464f5d237917282
- SHA1 3a27db2d1ac8a8fc30d972f4b9d7f91e99d7f96f
- SHA512 53e86805989a7a18964cb44ea514d1728a97931979bdbc991011a5a88fa8a49564f1bffb59ca061666cae37eb020e87c00c9d4361c2c5fb4f696f418e5ca7d53
- SSDEEP 3072:/dx2x7BPxWX3U+W67th1KA4D/cihCutl/vUu6T6fBuI2sc:/dx2xaUe7th1uD/cihC61UuSsc
- TLSH
  T135149D10309164E1C699B63BA45E7FA9CBE5E2123F7374963B3638DF6142BC33279A05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker botnet 2855 discovery gootkit trojan
- Family: Gootkit
  Gootkit is a banking trojan, where large parts are written in node.JS.
  trojan banker botnet gootkit
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bankerbotnet2855discoverygootkittrojan

behavioral2

bankerbotnet2855discoverygootkittrojan

behavioral3

bankerbotnet2855discoverygootkittrojan

© 2018-2026

Terms | Privacy