gootkit | f69e897d60ca8375b56acd33591b6d15c5e5083bd963309ef3cc290a3d81688a | Triage™

Login
Reports

Overview

overview

Static

static

3

jaffacakes...ai.exe

windows10-2004-x64

jaffacakes...ai.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Downloader.Win32.Upatre.gkai.e8d4e87d7f31eb396cff677b616e9db6
Size 525KB
Sample261006-rb7evazzdx
SHA256 f69e897d60ca8375b56acd33591b6d15c5e5083bd963309ef3cc290a3d81688a
MD5 e8d4e87d7f31eb396cff677b616e9db6
SHA1 ddf7d521d235b704af67a311fdd8b2c119a9c857
SHA512 64ec3ff7b4152a51c148b6915c7b04f983bf2a3b002fbc7602f4f00b150b45b60c91500f4a745b607e4ea6c0bb479dcb4326c1fd7dd48588ec615366022649f0
SSDEEP 12288:fu/FXlw9EP1QhRtibo7IThzB7eqy38VRQsJcOdg:sF1LP1tb0If7q8jQsJcOu
TLSH
T176B46C08F679F7B4C033287A068BF5B71A237931556A8D36B3850E16FA72B7A171274C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

gootkit 8888 banker botnet defense_evasion discovery execution privilege_escalation trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

jaffacakes118_Trojan-Downloader.Win32.Upatre.gkai.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

banker botnet 8888 defense_evasion discovery execution gootkit privilege_escalation trojan

Behavioral task

behavioral2

Sample

jaffacakes118_Trojan-Downloader.Win32.Upatre.gkai.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Malware Config

Extracted

Family

gootkit

Botnet

8888

C2

sslsecurehost.com
securessl256.com

Attributes

vendor_id
8888

Targets

- Target
  jaffacakes118_Trojan-Downloader.Win32.Upatre.gkai.e8d4e87d7f31eb396cff677b616e9db6
- Size 525KB
- SHA256 f69e897d60ca8375b56acd33591b6d15c5e5083bd963309ef3cc290a3d81688a
- MD5 e8d4e87d7f31eb396cff677b616e9db6
- SHA1 ddf7d521d235b704af67a311fdd8b2c119a9c857
- SHA512 64ec3ff7b4152a51c148b6915c7b04f983bf2a3b002fbc7602f4f00b150b45b60c91500f4a745b607e4ea6c0bb479dcb4326c1fd7dd48588ec615366022649f0
- SSDEEP 12288:fu/FXlw9EP1QhRtibo7IThzB7eqy38VRQsJcOdg:sF1LP1tb0If7q8jQsJcOu
- TLSH
  T176B46C08F679F7B4C033287A068BF5B71A237931556A8D36B3850E16FA72B7A171274C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker botnet 8888 defense_evasion discovery execution gootkit privilege_escalation trojan
- Family: Gootkit
  Gootkit is a banking trojan, where large parts are written in node.JS.
  trojan banker botnet gootkit
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Process Injection

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Process Injection

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bankerbotnet8888defense_evasiondiscoveryexecutiongootkitprivilege_escalationtrojan

behavioral2

© 2018-2026

Terms | Privacy