gootkit | 2452d8748e70de3bb68baf98dc56044bf9841b1f8c99c65b6bf50c1a04907d1e | Triage™

Login
Reports

Overview

overview

Static

static

3

tmp3p6afr4h.exe

windows10-ltsc_2021-x64

tmp3p6afr4h.exe

windows10-2004-x64

tmp3p6afr4h.exe

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

Target
tmp3p6afr4h
Size 187KB
Sample260609-py5tesbs4n
SHA256 2452d8748e70de3bb68baf98dc56044bf9841b1f8c99c65b6bf50c1a04907d1e
MD5 868dc2b29d1b9869a90b43ca983636bb
SHA1 3e5a81d4fe582a17fd2a863aa19151b5ae15a072
SHA512 7fc39ac9e2c451559b23f1122a3942048dd7d549b7ebe6139a458a624bbc88c4038a729c92ba7db386c00a58954b13777fd92dd53235d1a6bdc2ee04763e8049
SSDEEP 3072:s/3ZKRHYVpxS2AJXJMMJiIclByKCiscp7AgCoEt5D+ts+pGL0n6:svZxbxS2+JritlByFtcIoEt5YKw6
TLSH
T137149DB774CD52AFF4FF0D3AD42117C8EA93B5AE82A0280A0FF656FD054A5316A5E0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

gootkit 2853 banker botnet discovery trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

tmp3p6afr4h.exe

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

5 signatures

150 seconds

banker botnet 2853 discovery gootkit trojan

Behavioral task

behavioral2

Sample

tmp3p6afr4h.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

5 signatures

150 seconds

banker botnet 2853 discovery gootkit trojan

Behavioral task

behavioral3

Sample

tmp3p6afr4h.exe

Resource

win11-20260513-en

windows11-21h2-x64

5 signatures

150 seconds

banker botnet 2853 discovery gootkit trojan

Malware Config

Extracted

Family

gootkit

Botnet

2853

C2

wws.pleasantridgedrive.info
ogy5mtkwodmy.top

Attributes

vendor_id
2853

Targets

- Target
  tmp3p6afr4h
- Size 187KB
- SHA256 2452d8748e70de3bb68baf98dc56044bf9841b1f8c99c65b6bf50c1a04907d1e
- MD5 868dc2b29d1b9869a90b43ca983636bb
- SHA1 3e5a81d4fe582a17fd2a863aa19151b5ae15a072
- SHA512 7fc39ac9e2c451559b23f1122a3942048dd7d549b7ebe6139a458a624bbc88c4038a729c92ba7db386c00a58954b13777fd92dd53235d1a6bdc2ee04763e8049
- SSDEEP 3072:s/3ZKRHYVpxS2AJXJMMJiIclByKCiscp7AgCoEt5D+ts+pGL0n6:svZxbxS2+JritlByFtcIoEt5YKw6
- TLSH
  T137149DB774CD52AFF4FF0D3AD42117C8EA93B5AE82A0280A0FF656FD054A5316A5E0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker botnet 2853 discovery gootkit trojan
- Family: Gootkit
  Gootkit is a banking trojan, where large parts are written in node.JS.
  trojan banker botnet gootkit
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bankerbotnet2853discoverygootkittrojan

behavioral2

bankerbotnet2853discoverygootkittrojan

behavioral3

bankerbotnet2853discoverygootkittrojan

© 2018-2026

Terms | Privacy